fix(cli): address confirmed R75 defects and add regression coverage

[gummy789j]

QA cases:

• WALLETCLI-WAL-002: Validate import labels before persisting encrypted blobs or the master-password verifier. Preserve duplicate-import behavior.
• TC-BAI-009, TC-BAI-019: Preserve large integer and decimal precision when parsing usage-summary responses.
• TC-PAY-043: Send file and stdin request bodies as unchanged bytes. Enforce the 1 MiB byte limit and preserve stdin exclusivity checks.
• TC-PAY-028: Require --out for binary responses and strictly decode UTF-8 text. Preserve settlement and approval evidence on response errors.
• WALLETCLI-SEC-002: Escape line separators from external input in human error output while preserving raw JSON and authored multiline guidance. Retain safe text messages when payment errors are rewrapped.

Tests and documentation:

• Add regression coverage for the fixes and payment error propagation.
• Cap unit workers at 10 and retain the golden worker limit of 4.
• Document VITEST_MAX_WORKERS overrides and x402 raw-byte body behavior.
• Add QA expectation guidance for eight disputed cases.
• Record WALLETCLI-SEC-004 as Won’t Fix; do not add automatic temp cleanup