Add read-only pkg diagnostics: manifest dump, integrity verify, embedded ids

Three read-only endpoints (no install, no writes) to inspect a downloaded
package on-device:

- GET /api/manifest/<title_id> — re-fetch the patch manifest (PatchDL bypasses
  the DNS block) and dump each piece's offset/size/SHA-256.
- GET /api/pkgverify/<title_id> — SHA-256 every piece of the assembled .pkg
  against the manifest hashes, on-device (SSD, no multi-GB transfer), and report
  per-piece pass/fail. Proves whether the file is byte-correct.
- GET /api/pkgmeta/<title_id> — read the pkg's embedded content id + title id
  (GetContentIdFromPkg) vs the target ids, to expose cross-region linkage.

Supporting code: patchdl_sha256_fd_region() (pread + OpenSSL EVP) in the net
layer, and bind sceAppInstUtilGetContentIdFromPkg in the install backend.

Used to diagnose the Dead Island 2 install: the 61.6 GB package verifies
byte-perfect (17/17 pieces) and its content id matches the target, so the
0x80B2116F install rejection is a Sony install-method limitation, not the data.

src/patchdl_install.h

@@ -31,3 +31,9 @@ int patchdl_install_backend_check(char *msg, size_t msg_sz);
    AppInstUtil/Bgft patch-install symbols and report which exist on this
    firmware. Writes a JSON object into `out`. No install, no side effects. */
 int patchdl_install_api_probe(char *out, size_t out_sz);
+
+/* Read-only: report the .pkg's embedded content id + title id (and whether it
+   is a full app vs a patch, via *is_app). No install. 0 if anything was read. */
+int patchdl_install_pkg_meta(const char *local_path, char *content_id, size_t cid_sz,
+                             char *title_id, size_t tid_sz, int *is_app,
+                             char *msg, size_t msg_sz);