fix: three high-severity audit bugs (#21, #22, #23)

[offbyonebit]

Closes #21, closes #22, closes #23.

#21 Encrypted payloads destroyed on version or passphrase skew (data loss)

crypto.decrypt() returns None rather than raising on every failure path. So for a CSENC payload we cannot decrypt: _read_file() returns None → _seed_from_file() leaves _last_synced as None → the first OUT tick sees a difference and writes local plaintext over the peer's ciphertext. The other machine's data is gone.

The guard is in _write_file/_write_image_file, not a sticky instance flag. Reading the destination at write time is authoritative and self-correcting: it starts allowing writes again the moment the user configures the right passphrase, with no state to reset and no added stat() on the per-tick hot path.

_out_tick catches EncryptedPayloadError separately from OSError and reverts _last_synced under the lock, so the value is retried instead of being silently recorded as synced.

is_encrypted() now matches the version-agnostic b"CSENC" prefix rather than the three known magics. Previously a payload written by a newer build was not recognized as ciphertext at all, so the new guard would have walked straight past the mixed-version case that motivates it. This is the part that makes the v2 payload from 18065f4 safe to ship while 1.0.0 peers (v0/v1 only) are still in the field.

#22 History persistence not thread-safe

add_entry/clear/set_max_items released self._lock before calling _persist(), and _persist() serialized self._entries under no lock. _persist_locked() now requires the lock, held continuously from mutation through the write.

#23 Fixed temp filename

settings.json and the history file both wrote through a single shared .tmp name, so the tray and UI subprocesses could clobber each other. Both now use a pid-unique temp name with cleanup on failure.

Verification

• 146 unit tests pass; ruff and mypy clean.
• The 5 failures in tests/integration/test_real_clipboard.py are pre-existing on main and need a real X clipboard.
• Each regression test was confirmed to fail against the unfixed code: the 5 guard tests fail with the write-time check removed, and the concurrency test fails with persistence moved back outside the lock. The 2 success-path cases are controls that pass either way and are labelled as such.