Fix unbounded buffer growth in aead_decrypt chunk reassembly

The idx-tracking optimization in aead_decrypt skipped memmove when
partial AEAD chunks spanned multiple calls, but never compacted the
dead space before idx. This caused the chunk buffer to grow
proportionally to total data transferred (~10 MB growth per 10 MB
transferred), tripping the stress test memory leak threshold.

Compact residual data to the front when appending new ciphertext,
keeping the buffer bounded to the size of the residual plus new data.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/aead.c

@@ -650,9 +650,12 @@ aead_decrypt(buffer_t *ciphertext, cipher_ctx_t *cipher_ctx, size_t capacity)
         chunk->idx = 0;
         ciphertext->len = 0;
     } else {
-        brealloc(chunk,
-                 chunk->idx + chunk->len + ciphertext->len, capacity);
-        memcpy(chunk->data + chunk->idx + chunk->len,
+        if (chunk->idx > 0) {
+            memmove(chunk->data, chunk->data + chunk->idx, chunk->len);
+            chunk->idx = 0;
+        }
+        brealloc(chunk, chunk->len + ciphertext->len, capacity);
+        memcpy(chunk->data + chunk->len,
                ciphertext->data, ciphertext->len);
         chunk->len += ciphertext->len;
     }