polish: small SDK improvements grab-bag

[goanpeca]

Area: various

A collection of small, independent polish items from the audit. Each can be picked off individually:

• IncrementalSha256 / sha256Hex helper (src/streams/hash.ts) for S3-side/checksum workflows
• Throttle/coalesce ProgressTracker emissions (src/streams/progress.ts) instead of firing on every chunk
• FileAccountInfo should write the token file with 0600 permissions (src/auth/file.ts)
• EncryptionKey.generate() helper to mint a random SSE-C key (src/types/encryption.ts)
• Named const for the 's3' bucket/key option string; tighten stringly-typed options[] arrays
• Consolidate the three overlapping SSE-C shapes (SseCDownloadKey / SseCCustomerSetting / EncryptionKey)
• LocalFolder symlink policy (follow/skip + loop guard) (src/sync/scanners/local.ts)
• Async-iterable ContentSource (src/streams/source.ts)

Source: post-0.1.0 audit.