v4.1.0: source-only build, multithreaded-encryption fix, security hardening

Build from source with no vendored binaries:
- Remove prebuilt libzuptsdk.so / libpqvaptvupt.so (and a stray .pyc). The
  default build needs only a C compiler + make; it links no external library
  and installs no .so. The libzuptsdk-backed modes (Argon2id KDF, --pq-sdk,
  --pq-box) are gated behind an opt-in `make WITH_SDK=1`. The default password
  KDF is PBKDF2-SHA256 and --pq (native ML-KEM-768 + X25519) is the built-in PQ
  mode. openSUSE/RPM/deb/AUR/Homebrew/Nix recipes bumped to 4.1.0; the openSUSE
  spec now builds source-only (%files ships no .so, %build/%install WITH_SDK=0).

Fix: multithreaded encrypted archives were unextractable on the native AEAD
path. The parallel compress/decompress workers skipped the F-09 frame-preface
AAD that the serial path and the archive's AAD_PREFACE flag bind into every
block MAC, so each multithreaded block failed authentication. The workers now
bind the preface via a shared serializer; output is byte-identical across
thread counts and interoperates with single-threaded archives (also fixes
`--kdf pbkdf2 -t N` in any build).

Security hardening (crafted-archive memory safety + crypto):
- LZH raw code-length stack overflow + huff_lut OOB write
- overflow-safe bounds in parse_index and solid-mode extract (heap OOB read)
- SEQ decoder safe-zone heap overflow (litlen+matchlen reserve)
- require the per-block ENCRYPTED flag on encrypted archives (plaintext forgery)
- cap archive-supplied PBKDF2 iteration count (KDF-amplification DoS)
- non-elidable secret wipe in the SDK path; restored disk images created 0600

Docs: remove AUDIT.md / BENCHMARKS.md / ROADMAP.md; trim marketing/AI-styled
text and correct KDF/PQ facts across README, SECURITY, INSTALL, DISTRIBUTION,
THREAT_MODEL, THIRD-PARTY-NOTICES, the man page, and packaging READMEs. Wire
format v1.6 unchanged.

doc/vaptvupt.1

@@ -1,7 +1,7 @@
 .\" Manpage for vaptvupt (formerly zupt; INPI Brasil trademark rename in v3.0.0)
 .\" SPDX-License-Identifier: AGPL-3.0-or-later
 .\" Copyright (c) 2025-2026 Cristian Cezar Moisés
-.TH VAPTVUPT 1 "May 2026" "vaptvupt 4.0.0" "User Commands"
+.TH VAPTVUPT 1 "July 2026" "vaptvupt 4.1.0" "User Commands"
 
 .SH NAME
 vaptvupt \- post-quantum backup compression utility (formerly zupt)
@@ -205,7 +205,8 @@ Force a specific codec by id. Accepted values:
 
 .TP
 .BR -p " " \fIpassword\fR
-Enable password-based encryption (Argon2id KDF by default since v2.4.1).
+Enable password-based encryption (PBKDF2-SHA256 KDF; Argon2id is available
+only in a WITH_SDK=1 build via \fB--kdf argon2id\fR).
 Reading the password from a flag exposes it in
 .BR ps (1)
 output; prefer
@@ -517,7 +518,7 @@ On random / already-compressed data, all codecs hit the incompressibility wall;
 .SH EXAMPLES
 
 .PP
-Compress with default settings (Argon2id password, VaptVupt level 7, multi-threaded):
+Compress with default settings (PBKDF2-SHA256 password, VaptVupt level 7, multi-threaded):
 
 .RS
 .nf
@@ -530,8 +531,9 @@ Compress with post-quantum hybrid encryption to a published public key:
 .RS
 .nf
 $ vaptvupt keygen --sdk -o ~/.config/vaptvupt-mykey
-$ vaptvupt keygen --sdk --pub -o mykey.pub -k ~/.config/vaptvupt-mykey
-$ vaptvupt compress --pq-sdk mykey.pub backup.zupt ~/Documents
+$ vaptvupt keygen -o ~/.config/vaptvupt-mykey
+$ vaptvupt keygen --pub -o mykey.pub -k ~/.config/vaptvupt-mykey
+$ vaptvupt compress --pq mykey.pub backup.zupt ~/Documents
 .fi
 .RE