Fix MaxBytesReader limit breaking assignee requests and Decrypt panic on short input

[Copilot]

Security review of v0.3.0→v0.4.0 changes found two issues:

MaxBytesReader limit too small (API breaking change)

The 1024-byte MaxBytesReader limit silently breaks the assignee feature. Measured request sizes:

Request type	Size
SIGN (basic)	~1005 bytes
SIGN + assignee	~1535 bytes
SIGN + assignee + rotate	~1637 bytes

Basic SIGN barely fits; anything with an assignee is rejected outright. Increased to 4096.

crypto.Decrypt panics on short ciphertext

b[:aead.NonceSize()] panics with index-out-of-range when b is shorter than 12 bytes (GCM nonce). Reachable via API with a short base64-encoded data field. Added bounds check returning nil, consistent with existing error-handling pattern in the function.

// Before: panics if len(b) < 12
func Decrypt(secret, b []byte) []byte {
    aes, _ := aes.NewCipher(secret)
    aead, _ := cipher.NewGCM(aes)
    nonce := b[:aead.NonceSize()]  // panic

// After: returns nil on invalid input
    if len(b) < aead.NonceSize()+aead.Overhead() {
        return nil
    }

---

📱 Kick off Copilot coding agent tasks wherever you are with GitHub Mobile, available on iOS and Android.