fix(security): implement P3 high-entropy carrier default and P5 manifest capacity guard

src/carrier.rs

@@ -18,7 +18,7 @@ use futures_util::stream;
 use rand::rngs::OsRng;
 use rand::RngCore;
 use serde::{Deserialize, Serialize};
-use tracing::error;
+use tracing::{error, warn};
 use zeroize::{Zeroize, Zeroizing};
 
 use crate::crypto::{decrypt_chunk, encrypt_chunk, CHUNK_SIZE};
@@ -268,6 +268,20 @@ pub struct CarrierFsInner {
 impl CarrierFsInner {
     pub fn save_manifest(&mut self) -> Result<()> {
         let manifest_bytes = serde_json::to_vec(&self.manifest)?;
+        if manifest_bytes.len() > (crate::crypto::CHUNK_SIZE - 64) {
+            bail!(
+                "Carrier-Manifest überschreitet die maximale Blockgröße ({} > {} Bytes).",
+                manifest_bytes.len(),
+                crate::crypto::CHUNK_SIZE - 64
+            );
+        }
+        if manifest_bytes.len() > 800_000 {
+            warn!(
+                "Carrier-Manifest erreicht 80% der Blockkapazität ({}/{} Bytes)",
+                manifest_bytes.len(),
+                crate::crypto::CHUNK_SIZE - 64
+            );
+        }
         write_carrier_block(
             &self.db,
             self.carrier_node_id,