Harden breadcrumbs: fix real bugs, restructure as lib, stop storing PSKs twice

Bug fixes:
- mask() panicked on multi-byte UTF-8 passwords (byte-slicing a char
  boundary); now masks by char count and never echoes a real character
- `cd --shell` interpolated the config path into a shell -c string via
  Debug formatting, which doesn't neutralize shell metacharacters; now
  passed as a positional shell argument instead
- connecting to open (no-password) networks failed because an empty PSK
  was always sent to nmcli, which nmcli treats as secured-with-no-password
  instead of open; the password arg is now omitted entirely when empty
- five nmcli terse-output parse sites used a raw splitn(2, ':'), which
  mis-splits any device/connection name containing a literal ':'; unified
  on the existing escape-aware field splitter
- watch's health classifier silently read a config-deleted profile as
  "healthy" off a bare internet check instead of surfacing the misconfig
- the nmcli-monitor thread seeded its debounce clock with
  `Instant::now() - 10s`, which panics on the monotonic clock near boot —
  exactly when the generated systemd unit tends to start the watcher

Architecture:
- extracted src/lib.rs + src/app.rs so command logic can be exercised
  in-process by tests instead of only by spawning the compiled binary
- added a Runner trait (src/util.rs) so subprocess calls can be faked in
  tests; flow::run and watch::classify are now covered by real in-process
  tests of the connect state machine and health transitions, not just
  their pure helpers
- Wi-Fi passwords are no longer kept in breadcrumbs' config once
  NetworkManager durably holds them: NetworkDef.password is now optional,
  and a successful password-based connect clears + persists it
  immediately, so it's never sent again on subsequent connects
- saved networks (SSID + optional local password) moved out of
  breadcrumbs.toml into a separate networks.toml; old configs with
  inline [[networks]] still load and migrate automatically on next save
- corrected a false README claim that passwords are never in nmcli argv

Test count: 20 -> 89 (52 unit, 24 CLI integration, 13 in-process
state-machine tests). Full clean run: cargo build/build --release/
test/clippy --all-targets, verified from a `cargo clean` rebuild.

breadcrumbs.example.toml

@@ -4,6 +4,12 @@
 # just run breadcrumbs once (it generates a skeleton) and then use
 # `breadcrumbs add` / `breadcrumbs edit` to fill in your networks.
 # The real breadcrumbs.toml is gitignored and never committed.
+#
+# Saved networks (SSID + optional local password) live in a separate file,
+# networks.toml, in the same directory — not here. See
+# networks.example.toml for its format; in practice you never hand-edit it,
+# `breadcrumbs add` / `scan` / `forget` manage it for you. This file is just
+# settings + the location profiles built from those saved networks.
 
 [settings]
 dns = "1.1.1.1"
@@ -14,21 +20,6 @@ watch_interval = 12
 connectivity_url = "http://connectivitycheck.gstatic.com/generate_204"
 ping_host = "1.1.1.1"
 
-[[networks]]
-ssid = "HomeWifi"
-password = "REPLACE_ME"
-hidden = false
-
-[[networks]]
-ssid = "WorkGuest"
-password = "REPLACE_ME"
-hidden = false
-
-[[networks]]
-ssid = "CorpWifi"
-password = "REPLACE_ME"
-hidden = false
-
 # Location state machine. Switch with: breadcrumbs profile set <name>
 #
 # detect_ssids: list any SSIDs that reliably indicate you are at this location.