fix(security): implement P3 high-entropy carrier default and P5 manifest capacity guard

tests/carrier_model_a_test.rs

@@ -25,7 +25,7 @@ fn temp_db_path(prefix: &str) -> PathBuf {
 async fn test_model_a_carrier_filesystem_and_accounting_attack_resistance() {
     let path = temp_db_path("carrier_accounting");
     let carrier_size_bytes = 10 * 1024 * 1024; // 10 MB (10 Blöcke à 1 MB)
-    let carrier_name = "backup_image.iso";
+    let carrier_name = "system_backup.dat";
 
     let pass_decoy = "DecoyPassword2026!";
     let pass_hidden = "SuperSecretHiddenPassword2026!";
@@ -89,7 +89,7 @@ async fn test_model_a_carrier_filesystem_and_accounting_attack_resistance() {
     assert_eq!(*auth_hidden.carrier_dek().unwrap(), *dek_0);
     assert_eq!(auth_hidden.carrier_node_id(), Some(carrier_node_id));
 
-    // 2. Decoy Mount: Schutz der Alibi-Datei (backup_image.iso)
+    // 2. Decoy Mount: Schutz der Alibi-Datei (system_backup.dat)
     let decoy_fs = SanctumFs::with_carrier(
         db.clone(),
         auth_decoy.dek().clone(),
@@ -100,7 +100,7 @@ async fn test_model_a_carrier_filesystem_and_accounting_attack_resistance() {
         0,
     );
 
-    let carrier_path = DavPath::new("/backup_image.iso").unwrap();
+    let carrier_path = DavPath::new("/system_backup.dat").unwrap();
 
     // Metadaten der Alibi-Datei im Decoy prüfen
     let carrier_meta = decoy_fs.metadata(&carrier_path).await.expect("Carrier meta");