Address CodeQL and Dependabot findings

[Wasabules]

The scanners enabled in #10 produced their first findings: five CodeQL alerts
(one high) and one Dependabot advisory (high). Each is handled below, with what
it does — and does not — mean.

Dependabot: labstack/echo GHSA-vfp3-v2gw-7wfq (high)

Bumped 4.13.3 → 4.15.3. An indirect dependency, pulled in by Wails.

Shipped builds never contained the vulnerable code. Echo reaches this module
only through wailsapp/wails/v2/internal/frontend/devserver, which is behind
//go:build dev. Measured rather than assumed:

check	result
go list -deps ./...	0 echo packages linked
go list -tags dev -deps ./...	1 echo package linked
go version -m on the published v1.3.0 Windows binary	echo absent

So users were never exposed. The reachable surface was the developer machine
during wails dev. Worth fixing, not worth an emergency release — which is also
why this is a normal PR rather than a hotfix.

CodeQL go/allocation-size-overflow (high) — crypto.go

EncryptBytes sizes its output buffer as headerLen + len(plaintext) + gcm.Overhead(). That is an int addition, so on a 32-bit build a plaintext near
2 GiB would wrap and under-allocate before the copy ran.

Not reachable today: the only caller is CAStore.Save, passing a CA bundle of a
few kilobytes. But it is an exported entry point and nothing in the signature
says otherwise, so it is bounded at 64 MiB with an explicit error steering
callers with real volume to EncryptFile, which streams. Covered by a test that
checks both the rejection and that a normal payload still round-trips.

CodeQL go/unhandled-writable-file-close (4 warnings) — crypto.go, config.go

All four sit on error paths that close a file after a failed write and return the
original error. Discarding the Close error is defensible there — but not free:
on a buffered filesystem a deferred write failure surfaces only at Close, so
the discarded error can be precisely the one saying the file is incomplete. The
temp file is removed immediately after, which limits the cost to losing a
diagnosis rather than corrupting anything.

They now errors.Join both, so whichever error carries the useful detail
survives.

Also

Fixes the one real gofmt deviation in the tree — a double space before an
inline comment in logstore.go, which predates this branch.

Worth noting: gofmt -l flags three further files on a Windows checkout, which
is a CRLF artefact rather than a formatting problem (the repo stores LF via
.gitattributes, and a Linux checkout reports them clean). CI does not check
formatting at all — neither does SnmpLens. Adding gofmt -l to the quality
job would close that gap in three lines; left out here to keep this PR to the
alerts.

Verification

go build for both the release and the dev tag paths, go vet, staticcheck
and go test -race ./... all pass.