Add cargo-fuzz targets for the untrusted-input parsers and the hardening report

envelope_json, manifest_decode, item_replay, secret_key_parse, totp_parse, url_match,
with seeds. fuzz/README.md records the runs (and the server/desktop targets), the two
bugs fixed in the previous commits, dependency-policy results, CI changes and the
deploy check.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

fuzz/fuzz_targets/totp_parse.rs

@@ -0,0 +1,19 @@
+//! kv-model TOTP / otpauth:// parse, then code generation at fuzzed times.
+#![no_main]
+use kv_model::totp::Totp;
+use libfuzzer_sys::fuzz_target;
+
+fuzz_target!(|data: &[u8]| {
+    if data.len() < 8 {
+        return;
+    }
+    let t = u64::from_le_bytes(data[..8].try_into().unwrap());
+    let Ok(s) = std::str::from_utf8(&data[8..]) else { return };
+    if let Ok(totp) = Totp::parse(s) {
+        let code = totp.code_at(t);
+        assert_eq!(code.len(), totp.digits as usize);
+        assert!(code.bytes().all(|c| c.is_ascii_digit()));
+        let r = totp.remaining(t);
+        assert!(r >= 1 && r <= totp.period);
+    }
+});