Confluence import: the pure importer package

[Willyfrog]

Layer 3 of 7 in the Confluence page import stack, split out of #18. The design narrative and the accepted risks live in #18 — read it first; this PR is one layer of it.

Stack order: #30 → #31 → #32 → #33 → #34 → #35 → #36

The pure, side-effect-free half of the importer: no HTTP, no database, no plugin API. It parses and validates an mmetl Confluence v2 bundle and produces staged data for the layers above. Because it has no I/O, it is the one layer that can be reviewed and reasoned about entirely on its own.

What's here

archive.go (secure ZIP inspection), contract.go (the v2 JSONL line contract), inspect.go (the bundle walk), classify.go, tiptap.go (canonicalization), props.go, links.go, hash.go, issue_text.go — plus their tests.

What to look for

This is the layer that reads untrusted input, so it deserves security eyes:

• Archive handling — path traversal, symlinks, absolute paths, directory entries, zip bombs, and the ZIP64 end-of-central-directory locator (a bug here already bit once: an archive with a long comment was missed).
• Strict parsing — a line whose Type disagrees with its populated payload must be rejected, not coerced. Unknown object fields are tolerated on purpose for forward compatibility; confirm that is the only laxity.
• Size caps — MaxSourcePropsBytes is deliberately a fraction of PagePropsMaxBytes because these props end up nested inside the page's own Props. Check the arithmetic leaves real headroom.
• Hashing determinism — canonical hashes decide conflict detection above this layer, so map iteration order or float formatting leaking in would be silent and bad.

Verification

go build ./..., go vet ./... clean. server/importer suite green.