E16: add a cargo-fuzz harness

The repository had no fuzzing setup despite several natural targets —
the CSV parser, the Binance envelope deserializer, and the stateful
indicator/aggregator update paths.

Add a fuzz/ cargo-fuzz crate (detached from the workspace via its own
[workspace] table and the parent's exclude) with four targets:

- csv_reader      — CandleReader over arbitrary bytes
- binance_envelope — RawWsEnvelope deserialization from arbitrary strings
- indicator_update — RSI/EMA streaming + batch over arbitrary f64 series
- tick_aggregator — TickAggregator over arbitrary tick triples

Each target asserts the no-panic contract: malformed input must surface
as an Err. fuzz/README.md documents running them (nightly + cargo-fuzz).

fuzz/fuzz_targets/indicator_update.rs

@@ -0,0 +1,22 @@
+#![no_main]
+//! Fuzz indicator updates with arbitrary `f64` sequences.
+//!
+//! Every indicator must tolerate any finite-or-not input stream — NaN, ±inf,
+//! subnormals, abrupt jumps — without panicking, and `batch` must agree with
+//! the streaming `update` path.
+
+use libfuzzer_sys::fuzz_target;
+use wickra_core::{BatchExt, Ema, Indicator, Rsi};
+
+fuzz_target!(|data: Vec<f64>| {
+    let mut rsi = Rsi::new(14).unwrap();
+    let mut ema = Ema::new(20).unwrap();
+    for &x in &data {
+        let _ = rsi.update(x);
+        let _ = ema.update(x);
+    }
+
+    // batch over the same data must not panic either.
+    let _ = Rsi::new(14).unwrap().batch(&data);
+    let _ = Ema::new(20).unwrap().batch(&data);
+});