[TASK] ArchiveService implementation with streaming hash (P4)

[kirich1409]

Context

zstd-compress source with streaming sha256 via CryptoKit.SHA256.Hasher computed in-process; no second pass for verify.

Acceptance criteria

• Source read exactly once (AC-32).
• Verification = size > 0 + hash match.
• Atomic JSON index update through temp + rename + fsync.

Files to touch (estimate)

best-effort estimate; agent refines during implementation

Implementation notes

n/a

Dependencies

• Blocked by [SPIKE] zstd dependency choice #72

Safety checklist

See .github/ISSUE_TEMPLATE/task.yml — tick applicable invariants in the issue if any destructive path is touched.

Definition of Done

• Acceptance criteria satisfied and verifiable
• Tests added or updated
• No build / lint / test regressions
• Self-review against research-report invariants
• Code review approved