feat: add Chromium extract methods and source mapping (#521)

* feat: add Chromium extract methods, source mapping, and tests

Implement per-category data extraction for Chromium browsers as typed
standalone functions, preparing for Phase 8 wiring into the new
Chromium struct.

New files:
- source.go: dataSource struct, chromiumSources/yandexSources maps,
  yandexQueryOverrides for Yandex action_url variant
- decrypt.go: decryptValue() wrapping platform-specific decryption
- extract_password.go: SQLite + decrypt → []LoginEntry
- extract_cookie.go: SQLite + decrypt → []CookieEntry
- extract_creditcard.go: SQLite + decrypt → []CreditCardEntry
- extract_history.go: SQLite → []HistoryEntry
- extract_download.go: SQLite → []DownloadEntry
- extract_bookmark.go: JSON recursive → []BookmarkEntry
- extract_extension.go: JSON → []ExtensionEntry
- extract_storage.go: LevelDB → []StorageEntry (local + session)
- firefox/source.go: firefoxSources map

Tests use real Chrome table schemas for SQLite fixtures, with INSERT
helpers to keep test data readable and self-documenting.

Ref #520

* fix: remove LevelDB invalid path test (Windows compatibility)

leveldb.OpenFile creates the directory on Windows instead of returning
an error, causing TestExtractLocalStorage_InvalidPath to fail in CI.
This test was verifying LevelDB behavior, not our extraction logic.

* refactor: remove unused query parameter from extract functions

Only extractPasswords needs the query override (Yandex action_url).
The other 7 SQLite extract functions always use their default query,
so remove the unnecessary query parameter from their signatures.

* refactor: use DetectVersion in decryptValue instead of blind fallback

Replace try-then-fallback pattern with explicit version detection using
crypto.DetectVersion. Routes v10 to DecryptWithChromium, DPAPI to
DecryptWithDPAPI, and adds a TODO placeholder for v20 App-Bound
Encryption.

* chore: relax gocognit and gocritic linters for test files

* revert: restore strict gocognit and gocritic linters for test files

* fix: address review feedback on extract methods

- Store DetectVersion result in local variable to avoid duplicate call
- Scan credit card expiration_month/year as int then convert to string
  (matches INTEGER column type in real Chrome schema)
- Add os.Stat check before leveldb.OpenFile to prevent creating empty
  directories for non-existent paths
- Rename TestExtractExtensions_InvalidJSON to
  TestExtractExtensions_MissingSettingsPath (JSON is valid, path is missing)

* fix: revert creditcard scan to string type for NULL safety

modernc.org/sqlite handles INTEGER→string conversion automatically.
Scanning into string is safer for nullable columns — NULL becomes ""
instead of "0" which would be an invalid month/year.

browser/chromium/extract_bookmark_test.go

@@ -0,0 +1,74 @@
+package chromium
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestExtractBookmarks(t *testing.T) {
+	path := createTestJSON(t, "Bookmarks", `{
+		"roots": {
+			"bookmark_bar": {
+				"name": "Bookmarks Bar",
+				"type": "folder",
+				"children": [
+					{"name": "Go", "type": "url", "url": "https://go.dev", "date_added": "13360000000000000"},
+					{
+						"name": "News",
+						"type": "folder",
+						"children": [
+							{"name": "HN", "type": "url", "url": "https://news.ycombinator.com", "date_added": "13350000000000000"}
+						]
+					}
+				]
+			},
+			"other": {
+				"name": "Other",
+				"type": "folder",
+				"children": [
+					{"name": "GitHub", "type": "url", "url": "https://github.com", "date_added": "13370000000000000"}
+				]
+			}
+		}
+	}`)
+
+	got, err := extractBookmarks(path)
+	require.NoError(t, err)
+	require.Len(t, got, 3)
+
+	// Verify sort order: date added descending (newest first)
+	assert.Equal(t, "GitHub", got[0].Name)
+	assert.Equal(t, "Go", got[1].Name)
+	assert.Equal(t, "HN", got[2].Name)
+
+	// Verify field mapping
+	assert.Equal(t, "https://github.com", got[0].URL)
+	assert.Equal(t, "Other", got[0].Folder)
+
+	// Verify nested folder tracking
+	assert.Equal(t, "https://news.ycombinator.com", got[2].URL)
+	assert.Equal(t, "News", got[2].Folder) // parent folder name
+}
+
+func TestExtractBookmarks_FoldersExcluded(t *testing.T) {
+	path := createTestJSON(t, "Bookmarks", `{
+		"roots": {
+			"bookmark_bar": {
+				"name": "Bar",
+				"type": "folder",
+				"children": [
+					{"name": "EmptyFolder", "type": "folder", "children": []},
+					{"name": "Link", "type": "url", "url": "https://example.com", "date_added": "0"}
+				]
+			}
+		}
+	}`)
+
+	got, err := extractBookmarks(path)
+	require.NoError(t, err)
+	require.Len(t, got, 1) // only URL entries, not folders
+	assert.Equal(t, "Link", got[0].Name)
+	assert.Equal(t, "Bar", got[0].Folder)
+}