fix: harden remote filename sanitization

[ryanfowler]

Summary

• reject Windows-forbidden characters in remote filenames across platforms
• reject trailing spaces/dots and decoded slash separators in URL-derived names
• add coverage for unsafe Content-Disposition and URL fallback cases

Validation

• cargo fmt --check
• cargo test --locked --all-features output::tests:: --lib