refactor: split main.rs into modules (#44)

* refactor: split main.rs into cli, io, macros, and commands modules

Split the 1256-line main.rs into a modular structure:
- cli.rs: CLI definitions (Cli, Commands, Algorithm, OutputFormat)
- macros.rs: 6 dispatch macros (kem_keygen!, dsa_keygen!, etc.)
- io.rs: encode/decode helpers and write_secret_file
- commands/: 7 command handlers (keygen, encaps, decaps, sign, verify, info, completions)
- main.rs: entry point with mod declarations and match dispatch only

No functional changes. All 30 tests pass.

* fix: address PR review comments for module split

- Fully-qualify rng(), Zeroizing, anyhow!() in dispatch macros to
  eliminate hidden caller-side import dependencies
- Add sync_all() before rename in write_secret_file for crash safety
- Clean up temp file on rename failure to avoid leaving secret material
- Remove now-unused anyhow/rng imports from command modules and io.rs

* fix: correct function names in unreachable branch comments

Update comments referencing nonexistent `detect_kem_algorithm` to the
actual method names: `detect_kem_from_pub_key` and `detect_kem_from_sec_key`.

Author: kiyoaki

PLANS.md

@@ -22,6 +22,7 @@ CLI tool for kylix-pqc post-quantum cryptography library.
 | Review Findings Fix | HIGH | [H-1] Windows permission warning, [H-3] Zeroize sk_encoded, [M-1] SLH-DSA ambiguous detection error, [L-1] Zeroizing wrappers, [L-4] BTreeMap for deterministic output, [M-5] SLH-DSA integration tests |
 | Bench Release Build Fix | HIGH | `--release` missing from external-tool-compare CI job, causing ~100x slowdown vs liboqs |
 | [H-2] Shared Secret Output Control | HIGH | `--secret-file` option for encaps/decaps to write shared secret to file instead of console |
+| [M-2] Split main.rs into Modules | MEDIUM | Split 1256-line main.rs into cli.rs, io.rs, macros.rs, and commands/ directory |
 
 ---
 
@@ -33,7 +34,6 @@ CLI tool for kylix-pqc post-quantum cryptography library.
 | OpenSSL Dedup | LOW | Extract common logic from KEM/SIG benchmark functions |
 | liboqs Parsing | LOW | Parse column headers instead of hardcoded indices |
 | wolfSSL Support | LOW | Add wolfSSL as external benchmark tool |
-| [M-2] Split main.rs into Modules | MEDIUM | Separate cmd_* functions, algorithm definitions, and I/O helpers into modules |
 | [M-3] Input Format Disambiguation | MEDIUM | Improve hex vs base64 auto-detection for edge cases |
 | [M-4] Deep Zeroization in encode/decode | MEDIUM | Zeroize intermediate strings in `encode_output`/`decode_input` (PEM wrapping, base64) |
 | [L-5] Windows ACL for Secret Keys | LOW | Enforce restrictive ACLs on secret key files on Windows (e.g. `windows-acl` crate) |

kylix-cli/src/bench.rs

@@ -17,7 +17,7 @@ use std::path::PathBuf;
 use std::process::Command;
 use std::time::{Duration, Instant};
 
-use crate::Algorithm;
+use crate::cli::Algorithm;
 
 // liboqs benchmark duration estimation constants
 //