feat: harden Maple and prepare 0.2.0

[Fuwn]

Prepare Maple 0.2.0 with safer Gemini and Titan request handling and refreshed build tooling. Content access is confined to the capsule root, completed uploads are published atomically, and timeouts prevent stalled connections from blocking the server indefinitely.

Changes

• Validate Gemini and Titan URLs, decode path components once, and keep queries separate from file selection and upload parameters.
• Reject invalid Titan parameters and sizes, and preserve existing files when uploads are incomplete.
• Serve new and updated content immediately, and stream Gemini responses.
• Add MAPLE_PORT to configure the listening port, retaining 1965 as the default.
• Consolidate builds and tests on Ninja, refresh Nix dependencies, simplify the flake, and add automated regression checks.
• Run Docker containers as a non-root user and prevent certificate generation from overwriting existing keys.

Upgrade Notes

• Content must be regular .gmi files under .maple/gmi. Traversal, symlinks, and encoded path separators are rejected.
• The TLS handshake and request header share a five-second absolute deadline. Transfers have a 15-second inactivity timeout.

Validation

• All 44 regression tests passed in Nix and Docker builds.
• Builds passed with strict Clang diagnostics. Nix formatting and whitespace checks passed.