merge: resolve dev (quality refactor) into security-fixes

- file.c split layout retained; security-hardened secure-fs helpers
  (open_secure_parent/to_disk_secure/rename_secure/stat_secure) now live in
  file.c with file_ prefix and are shared with file_receive.c
- file_receive.c takes the security branch's bounded allocations
  (receive_data_limited, data_decompress_limited, size checks) and
  STATUS_ERROR signaling
- file_send.c gains the data consistency check on file->data
- client_validation.c: stricter --tls requiring --ca, log_message style
- utils.c: hardened openat/mkdirat mkdir_r from security branch

src/shared/config.c

@@ -145,7 +145,7 @@ Config* config_create(void) {
   return config;
 }
 
-bool is_remote_dest(const char* s) {
+bool config_is_remote_dest(const char* s) {
   if (s == NULL)
     return false;
   const char* colon = strchr(s, ':');
@@ -161,7 +161,7 @@ bool is_remote_dest(const char* s) {
 }
 
 void config_parse_ssh_dest(Config* config) {
-  if (!is_remote_dest(config->receive_root_directory))
+  if (!config_is_remote_dest(config->receive_root_directory))
     return;
   config->transport = TRANSPORT_SSH;
   config->ssh_destination = str_dup(config->receive_root_directory);