Function decrypt_file 

pub fn decrypt_file(
    password: &str,
    input: &Path,
    output: &Path,
) -> Result<String>

Decrypts a .krf container into output.

Returns the original filename recovered from the authenticated trailer.

Security notes:

• The plaintext is written via temp-file + rename; an interrupted decryption never leaves a half-written file behind.
• The returned filename originates inside the encrypted container. Treat it as untrusted data; if used to build filesystem paths, pass it through crate::sanitize::sanitize_stored_name first.