Security hardening across Python, Rust, and TypeScript implementations

[jaschadub]

No wire-format or canonicalization changes — pure implementation hardening.

Python (src/vectorpin/, tests/):

• CLI keygen writes private key with mode 0600 via O_EXCL; parent dir 0700; refuses to clobber existing key
• Pin.from_json/from_dict: 64 KiB size cap, strict type checks on every field, sig length == 64, hash regex, extra values must be strings
• Verifier returns SIGNATURE_INVALID for non-bytes or wrong-length sig before reaching the cryptography library
• Audit loop catches per-record parse errors and continues (one bad row no longer aborts the audit)
• LanceDB adapter validates id_column/vector_column/pin_column against identifier regex; rejects record_id containing NUL/newline/backslash
• Qdrant + Pinecone adapters refuse api_key over http:// for non-loopback hosts unless VECTORPIN_ALLOW_INSECURE_HTTP=1
• Signer.from_pem requires explicit password= or allow_unencrypted=True
• pyproject.toml: cryptography >=42,<46; numpy >=1.26,<3

Rust (rust/vectorpin/):

• #![forbid(unsafe_code)] on the crate
• Signer::generate -> Result<Self, SignerError::EmptyKeyId>
• Signer::private_key_bytes -> Zeroizing<[u8; 32]>
• vec_dim cast via u32::try_from on signer + verifier sides
• Verifier::add_key -> Result<(), VerifyError::KeyDecodeFailed>
• Pin parser rejects non-string values in extra (ExtraTypeMismatch)
• Replaced home-rolled date arithmetic with time crate (RFC3339 format preserved byte-for-byte)

TypeScript (typescript/):

• @noble/ed25519 pinned to exact 2.3.0; @noble/hashes to 1.8.0
• pinFromDict: rejects proto/constructor/prototype, unknown top-level keys, non-string extra values; strict typeof checks; hash regex; sig length == 64; base64url alphabet enforced
• pinFromJSON: 64 KiB cap; extra capped at 32 entries
• Switched signing/verifying to async API (signAsync/verifyAsync) and removed the globally-mutable ed25519.etc.sha512Sync hook
• Signer.fromPrivateBytes makes a defensive copy; new wipe() method
• Module-load assertion that crypto.getRandomValues is available
• Verifier detail strings are sanitized (strip control chars, truncate)

New tests: tests/test_cli_keygen_perms.py, tests/test_signer_from_pem.py, rust/vectorpin/tests/hardening.rs, typescript/test/attestation.test.ts, plus expanded coverage in the existing suites.

All tests pass: Python 83, Rust 24 unit + 9 hardening + 2 cross_lang + 12 doc, TypeScript 58.