Validate cell characters and digit/period sanity

Halt import on control characters or a ':'/'/' inside an issuer or
account (they collide with the OATH issuer:account separator and period/
prefix), on a composed name over 64 bytes with a clearer per-field
message, and on a digit count outside 6-8 or a non-positive period.

docs/design.md

@@ -144,12 +144,21 @@ Companion `test_oath.py` — hardware-free unit tests.
 
 ## Pre-flight validation rules (halt on any)
 
-- Duplicate `cred_id` within the input (e.g. the two
-  `SAW:michelle@dangerousthings.com` entries with different secrets).
+- Duplicate `cred_id` within the input (e.g. two entries that map to the same
+  `issuer:account`).
 - Secret missing or not valid Base32 after uppercasing and removing spaces.
 - Decoded key length > 64 bytes.
-- `cred_id` (UTF-8) length > 64 bytes.
+- Composed name (`issuer:account`, UTF-8) length > 64 bytes.
 - Algorithm SHA512 (unsupported by the applet), or a non-TOTP/HOTP type.
+- Control characters (byte < 0x20 or 0x7F) anywhere in the issuer or account.
+- A literal `:` or `/` inside the issuer or account (they collide with the OATH
+  `issuer:account` separator and the `period/` name prefix, so they break
+  round-trip/display in authenticator apps, even though the applet stores them).
+- Digit count outside 6-8, or a non-positive period.
+
+The applet itself imposes only the length limits; the character and
+digit/period rules are host-side guards for OATH-convention and app
+compatibility.
 
 Each problem is reported with the offending issuer/account and source row.