feat(opsec-ux): implement HF-01 to HF-04 and VFS carrier protection

- HF-01: eliminate visual leaks between decoy and hidden vaults during mount
- HF-02: add secure interactive BIP-39 recovery prompt avoiding shell history
- HF-03: implement BIP-39 normalization, word index error pinpointing, and Levenshtein typo suggestions
- HF-04: add --stealth mode for silent mounting in high-risk environments
- VFS: enforce write, truncate, delete, rename, and directory removal protection for carrier node in decoy vault

src/storage.rs

@@ -281,6 +281,24 @@ impl Database {
         Ok(id)
     }
 
+    /// Prüft, ob ein Knoten (z. B. der Carrier-Knoten) ein Nachfahre (direkt oder indirekt) eines Verzeichnisses ist.
+    pub fn is_descendant_of(&self, node_id: i64, ancestor_id: i64) -> Result<bool> {
+        if node_id == ancestor_id {
+            return Ok(true);
+        }
+        let conn = self.conn.lock().unwrap();
+        let mut stmt = conn.prepare(
+            "WITH RECURSIVE sub(id) AS (
+                SELECT id FROM nodes WHERE id = ?1
+                UNION ALL
+                SELECT n.id FROM nodes n JOIN sub ON n.parent_id = sub.id
+            )
+            SELECT 1 FROM sub WHERE id = ?2 LIMIT 1;",
+        )?;
+        let exists: Option<i64> = stmt.query_row(params![ancestor_id, node_id], |r| r.get(0)).optional()?;
+        Ok(exists.is_some())
+    }
+
     /// Überschreibt Chunks eines Knotens vor dem Löschen mit kryptografischem Zufallsrauschen (Chunk Shredding).
     pub fn shred_chunks_for_node(&self, node_id: i64) -> Result<()> {
         let conn = self.conn.lock().unwrap();