Implement complete integrity verification module with streaming hasher

Replace the stub hash_file function with a full implementation that reads
files in 64 KiB chunks through std::io::copy into a SHA-256 hasher,
avoiding memory pressure for arbitrarily large inputs. Add hash_bytes_raw
for callers that need the 32-byte binary digest rather than a hex string.
hash_reader accepts any io::Read source, enabling hash computation on
network streams or in-memory buffers without materializing intermediate
files.

Introduce StreamingHasher for incremental hash computation across
multiple update calls. This is designed for chunked network reception
where the full data is never in memory at once: the receiver calls update
on each chunk as it arrives, then finalize or finalize_raw to obtain the
digest. The struct wraps sha2::Sha256 and implements Default.

Verification helpers verify_hash and verify_file_hash compare computed
hashes against expected hex strings, returning bool rather than Result for
use in assert-style checks. The crypto module’s sha256_hex and sha256_file
functions are updated to delegate to the integrity module, making it the
single canonical location for SHA-256 operations.

Ten tests cover known-answer vectors for the empty string and ‘hello
world’, raw hash byte length, file hashing including a 10 MB large-file
path to exercise chunked I/O, hash verification for both match and
mismatch cases, file verification, streaming hasher correctness against a
known answer, streaming-vs-oneshot equivalence across four chunks, and
hash_reader with an in-memory source.