refactor: trim library exports to what callers actually use

The initial lib.rs re-exported the whole policy limit surface even
though nothing outside the library used most of it. Every unused
export is semver surface for free: tightening MAX_ARGON_PASSES or
removing architecture_argon_cap_mib later would be a breaking change
for constants nobody asked for.

Drop the re-exports with zero uses in main.rs and the tests:

- policy: DEFAULT_ARGON_DECRYPT_CAP_MIB, MIN_ARGON_MEMORY_MIB,
  MAX_ARGON_PASSES, MAX_ARGON_PARALLELISM, MAX_CHUNK_SIZE,
  MIN_PASSPHRASE_BYTES, architecture_argon_cap_mib
- secrets: MAX_PASSPHRASE_LEN

All of them stay pub inside their (private) modules because the
validation functions use them internally; they can be re-exported
deliberately if a downstream user ever needs to introspect the limits.
ArgonDecryptCap stays exported because it is the return type of the
exported resolve_argon_decrypt_cap. The header format exports
(Header, AlgId, flags, lengths) are kept as the blessed container
format API.

Breaking change for any out-of-tree user of the just-introduced lib
API, but the library has not shipped in a release yet.

Test plan: cargo clippy (default/--tests) clean; cargo test passes
all suites.

src/lib.rs

@@ -35,30 +35,16 @@ pub use crate::{
     },
     policy::{
         ArgonDecryptCap,
-        DEFAULT_ARGON_DECRYPT_CAP_MIB,
         DEFAULT_ARGON_MEMORY_MIB,
         DEFAULT_ARGON_PARALLELISM,
-        MAX_ARGON_PARALLELISM,
-        MAX_ARGON_PASSES,
-        MAX_CHUNK_SIZE,
         MAX_WORKER_THREADS,
-        MIN_ARGON_MEMORY_MIB,
         MIN_ARGON_PASSES,
-        MIN_PASSPHRASE_BYTES,
-        architecture_argon_cap_mib,
         default_argon_decrypt_cap_mib,
         normalize_worker_threads,
         resolve_argon_decrypt_cap,
         validate_new_argon_params,
         validate_new_passphrase,
     },
-    secrets::{
+    secrets::{SecretBytes32, SecretVec, normalize_passphrase, read_key_file, read_passphrase_tty},
-        MAX_PASSPHRASE_LEN,
-        SecretBytes32,
-        SecretVec,
-        normalize_passphrase,
-        read_key_file,
-        read_passphrase_tty,
-    },
     utils::{DEFAULT_CHUNK_SIZE, OutputOptions},
 };