fix: strip host_key prefix from Chrome 130+ cookie values (#526)

* fix: strip SHA256(host_key) prefix from Chrome 130+ cookie values

Chrome 130 (Cookie DB schema v24) prepends SHA256(domain) to cookie
values before encryption to prevent cross-domain replay attacks.
After decryption, this 32-byte hash must be verified and stripped.

Changes:
- Add stripCookieHash() that verifies SHA256(host_key) and strips
  the prefix only when it matches (auto-compatible with older Chrome)
- Fix edge case: cookies with empty values (exactly 32 bytes = hash only)
- Add decrypt_test.go with v10 round-trip encryption/decryption test
- Add stripCookieHash test cases for v24+, older Chrome, empty values,
  short values, and host mismatch scenarios

Closes #524

* fix: strip SHA256(host_key) prefix from Chrome 130+ cookie values

Chrome 130 (Cookie DB schema v24) prepends SHA256(domain) to cookie
values before encryption to prevent cross-domain replay attacks.
After decryption, this 32-byte hash must be verified and stripped.

Changes:
- Add stripCookieHash() that verifies SHA256(host_key) and strips
  the prefix only when it matches (auto-compatible with older Chrome)
- Fix edge case: cookies with empty values (exactly 32 bytes = hash only)
- Add table-driven decrypt tests for v10/v20/DPAPI per platform
- Add Windows-specific DPAPI round-trip test using CryptProtectData
- Add shared testAESKey constant in testutil_test.go
- Add stripCookieHash tests for v24+, older Chrome, empty values,
  short values, and host mismatch scenarios
- Extend lint CI to run on ubuntu, windows, and macos

Closes #524

* fix: remove DPAPI test from darwin/linux (returns nil on Linux)

DecryptWithDPAPI returns nil error on Linux (silent no-op) but error
on macOS, causing the test to fail on Ubuntu CI. DPAPI round-trip
testing is properly covered in decrypt_windows_test.go.

* fix: resolve Windows CI lint errors exposed by multi-platform lint

- Add _ = before windows.CloseHandle calls to satisfy errcheck
- Add build tag to params.go (only used on macOS/Linux, not Windows)

* fix: add .gitattributes to force LF and refactor cookie tests

- Add .gitattributes with `* text=auto eol=lf` to prevent CRLF
  conversion on Windows CI causing gofumpt false positives
- Add .gitattributes to .gitignore whitelist
- Refactor stripCookieHash tests into table-driven style

* fix: address Copilot review on decrypt tests

- Assert error on wrong key instead of ignoring it (AES-CBC returns
  padding error, not silent empty result)
- Guard empty plaintext in encryptWithDPAPI to prevent nil pointer panic
- Convert uint32 to int for make/copy slice bounds in Windows test

* fix: assert specific error message in wrong key decrypt test

filemanager/copy_windows.go

@@ -127,7 +127,7 @@ func findFileHandle(targetPath string) (windows.Handle, error) {
 			0, false,
 			windows.DUPLICATE_SAME_ACCESS,
 		)
-		windows.CloseHandle(process)
+		_ = windows.CloseHandle(process)
 		if err != nil {
 			continue
 		}
@@ -135,21 +135,21 @@ func findFileHandle(targetPath string) (windows.Handle, error) {
 		// Verify it's a disk file (not a pipe, device, etc.)
 		fileType, _, _ := procGetFileType.Call(uintptr(dupHandle))
 		if fileType != fileTypeDisk {
-			windows.CloseHandle(dupHandle)
+			_ = windows.CloseHandle(dupHandle)
 			continue
 		}
 
 		// Get the file path and check if it matches our target
 		name, err := getFinalPathName(dupHandle)
 		if err != nil {
-			windows.CloseHandle(dupHandle)
+			_ = windows.CloseHandle(dupHandle)
 			continue
 		}
 
 		if strings.HasSuffix(strings.ToLower(name), targetSuffix) {
 			return dupHandle, nil
 		}
-		windows.CloseHandle(dupHandle)
+		_ = windows.CloseHandle(dupHandle)
 	}
 
 	return 0, fmt.Errorf("no process has file open: %s", targetPath)