fix: address critical security vulnerabilities and documentation inaccuracies

[ShaneIsley]

Security fixes:

• Fix insecure Unix socket permissions (0666 → 0600) in daemon.go
  Prevents unauthorized users from accessing the daemon socket
• Remove CURL_CA_BUNDLE="" that disabled TLS certificate validation
  This was silently making all curl operations vulnerable to MITM attacks

Documentation fixes:

• Change "Zero dependencies" to "Minimal dependencies" (README.md:22)
  The claim was false - project uses Cobra, Viper, SQLite, etc.
• Change "11 backoff strategies" to "10 backoff strategies" (README.md:17)
  Only 10 strategies are actually implemented

Code quality improvements:

• Improve HTTP JSON parsing with proper brace matching instead of
  naive first-{ to last-} heuristics that could match unrelated content
• Add findMatchingBrace() helper that handles strings and escaping
• Limit JSON search to 10KB to avoid processing huge outputs
• Add architectural note about daemon.go duplicating UnixServer logic

https://claude.ai/code/session_01NSTdboMz5UFPifG8cDfVr1