Fix capacity overflow panic and validate punchcard account layout

[benedictbrady]

Summary

• prevent overflow in punchcard account sizing by using checked arithmetic for capacity
• reject invalid capacities during Create with a dedicated custom error (InvalidCapacity)
• harden Claim parsing by validating account data length/shape before accessing bitset storage
• reject malformed state where claimed > capacity
• add unit tests covering overflowed capacities and malformed account data

Security impact

This fixes a panic path where large capacities (for example u64::MAX) under-allocate account data in release builds, then panic on Claim due to out-of-bounds bitset access.

Testing

• cargo test --lib
• cargo test --release --lib