fix: reject corrupted attachment stream decrypts

[Ap4sh]

summary

• make attachment stream decrypt wrappers throw when Decryptor::update() or finalize() rejects corrupted data
• keep partial output cleanup for file decrypt paths
• add coverage for final-byte corruption and full-chunk corruption across the file/buffer decrypt wrappers

testing

• cmake -G Ninja -S . -B Build -DENABLE_NETWORKING=ON -DUSE_LTO=OFF
• ./utils/format.sh verify
• cmake --build Build --target testAll --parallel 4
• Build/tests/testAll "Attachment streaming decryption rejects corrupted data" -s
• Build/tests/testAll "Attachment streaming decryption rejects corrupted full chunks" -s
• Build/tests/testAll "[attachments]"
• Build/tests/testAll