feat: import KeePassXC CSV exports

[floze-the-genius]

What does this change?

Adds blindkey import --format keepass-csv with keepassxc-csv as the accepted-spec alias.

• maps Group, Title, Username, Password, URL, Notes, and TOTP by normalized header name
• accepts RFC 4180 quoting, embedded commas/newlines, UTF-8 BOM, CRLF, and reordered columns
• treats formula-like cells as opaque data and keeps passwords/TOTP in protected, zeroizing storage
• preserves the existing masked review and performs one vault save only after confirmation
• bounds input to 64 MiB, fields to 64 KiB, and imports to 10,000 rows
• reports unknown columns only as a count
• adds a synthetic fixture, CLI vault round-trip, malformed-input tests, and a fuzz target

Closes #30.

Affected constraints

• Constraints: C21, C27, C30, C31
• New constraint added? N

Checklist

• Pinned Rust 1.96.0 fmt, clippy -D warnings, and full workspace tests pass
• cargo audit, cargo deny check, and cargo vet pass
• New behavior has tests mapped to C21/C27/C30/C31
• No secret material can reach a log, Debug, default stdout, or argv
• No unsafe or custom crypto added
• Conventional Commit message
• I agree to license my contribution under MIT OR Apache-2.0

Security impact

This adds a hostile-input parser at the migration boundary. It uses csv-core for quoting/unescaping with a fixed zeroizing field buffer, rejects oversized inputs before vault unlock, validates the complete import before mutation, masks review output, and commits through the existing backup + single-save path. csv-core is version-pinned in Cargo.lock and the repository's cargo-vet exemptions.

Validation

• cargo fmt --all -- --check
• cargo clippy --all-targets --all-features -- -D warnings
• cargo test --all-features --workspace
• cargo test -p blindkey-cli --test cli keepassxc_csv_round_trips_into_vault_after_masked_review -- --nocapture
• cargo check --manifest-path fuzz/Cargo.toml --bin keepassxc_csv
• cargo audit
• cargo deny check
• cargo vet

[floze-the-genius]

Upstream main added mandatory per-commit DCO enforcement in 979f1cc after this PR's commit was created. The existing commit 38166d4 has no Signed-off-by trailer, and I am not providing a DCO certification or authorizing one on my behalf. Please do not treat this comment as a DCO attestation.

A normal Update branch or merge commit will not satisfy the configured action because it still checks the original unsigned non-merge commit. If the project wants to accept the patch without contributor DCO, please use an explicit maintainer-driven path: either recreate/apply the patch in a new maintainer-owned commit and sign it in the maintainer's own capacity after independently confirming provenance and licensing, or adopt an explicit grandfather/exemption policy through the project's governance process. PR #38 should remain open until such a replacement path is confirmed.

[floze-the-genius]

Rebuilt this branch on the current main after the upstream history change. The PR is now the intended single feature commit (ab42932) and has dropped from 262 files / +19,426 −2,408 lines to 16 files / +484 −30 lines. The only content conflict was in CHANGELOG.md; both the current unreleased entries and the KeePassXC entry are preserved. I also corrected the commit identity to the GitHub-linked Floze address.

Fresh validation on the rebased head with the repository-pinned Rust 1.96 toolchain:

• cargo fmt --all -- --check
• cargo test -p blindkey-core import --locked — 10 passed
• cargo test -p blindkey-cli --test cli keepass --locked — round-trip passed
• cargo clippy -p blindkey-core -p blindkey-cli --all-targets --locked -- -D warnings
• git diff --check

This rewrite does not add a Signed-off-by trailer or alter the DCO position stated above.