E16: add a cargo-fuzz harness

The repository had no fuzzing setup despite several natural targets —
the CSV parser, the Binance envelope deserializer, and the stateful
indicator/aggregator update paths.

Add a fuzz/ cargo-fuzz crate (detached from the workspace via its own
[workspace] table and the parent's exclude) with four targets:

- csv_reader      — CandleReader over arbitrary bytes
- binance_envelope — RawWsEnvelope deserialization from arbitrary strings
- indicator_update — RSI/EMA streaming + batch over arbitrary f64 series
- tick_aggregator — TickAggregator over arbitrary tick triples

Each target asserts the no-panic contract: malformed input must surface
as an Err. fuzz/README.md documents running them (nightly + cargo-fuzz).

fuzz/fuzz_targets/csv_reader.rs

@@ -0,0 +1,17 @@
+#![no_main]
+//! Fuzz the OHLCV CSV reader with arbitrary byte input.
+//!
+//! The reader must never panic: malformed headers, non-numeric cells,
+//! truncated rows and arbitrary binary data all have to surface as an
+//! `Err`, never a crash.
+
+use libfuzzer_sys::fuzz_target;
+use wickra_data::csv::CandleReader;
+
+fuzz_target!(|data: &[u8]| {
+    if let Ok(mut reader) = CandleReader::from_reader(data) {
+        for candle in reader.candles() {
+            let _ = candle;
+        }
+    }
+});