E16: add a cargo-fuzz harness

The repository had no fuzzing setup despite several natural targets —
the CSV parser, the Binance envelope deserializer, and the stateful
indicator/aggregator update paths.

Add a fuzz/ cargo-fuzz crate (detached from the workspace via its own
[workspace] table and the parent's exclude) with four targets:

- csv_reader      — CandleReader over arbitrary bytes
- binance_envelope — RawWsEnvelope deserialization from arbitrary strings
- indicator_update — RSI/EMA streaming + batch over arbitrary f64 series
- tick_aggregator — TickAggregator over arbitrary tick triples

Each target asserts the no-panic contract: malformed input must surface
as an Err. fuzz/README.md documents running them (nightly + cargo-fuzz).

fuzz/Cargo.toml

@@ -0,0 +1,46 @@
+[package]
+name = "wickra-fuzz"
+version = "0.0.0"
+publish = false
+edition = "2021"
+
+[package.metadata]
+cargo-fuzz = true
+
+[dependencies]
+libfuzzer-sys = "0.4"
+serde_json = "1"
+wickra-core = { path = "../crates/wickra-core" }
+wickra-data = { path = "../crates/wickra-data", features = ["live-binance"] }
+
+# Detach this crate from the parent workspace — cargo-fuzz builds it on its
+# own with sanitizer flags.
+[workspace]
+
+[[bin]]
+name = "csv_reader"
+path = "fuzz_targets/csv_reader.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "binance_envelope"
+path = "fuzz_targets/binance_envelope.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "indicator_update"
+path = "fuzz_targets/indicator_update.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "tick_aggregator"
+path = "fuzz_targets/tick_aggregator.rs"
+test = false
+doc = false
+bench = false