Add closures and unsafe; base16ct's lower.rs and upper.rs go through

`unsafe` is a permission marker, not a semantic change -- it does not alter
what the enclosed operations mean -- so the block is transparent and every
operation inside still goes through the ordinary lowering and is still
rejected if it has no faithful mapping. `unsafe fn` lowers like any proc.

A closure becomes a Nim anonymous proc. Nim's closures capture by reference,
as Rust's non-`move` closures do; a `move` closure captures by value, which
is a different thing, so it is rejected rather than lowered to the same
construct. `impl Fn(A) -> B` is left at Nim's default calling convention,
which accepts both a plain top-level proc and a capturing closure, just as
Rust's `impl Fn` does. `.map`/`.and_then` over an Option/Result are expanded
inline with the closure's parameter aliased to the payload, which keeps the
whole thing an expression and keeps a view a view.

`&str` is a borrowed view of someone else's bytes, so it now maps to
openArray[char] rather than an owned string; Nim accepts a string argument
for an openArray[char] parameter, so literals still pass through.
from_utf8_unchecked reinterprets a byte view as a character view over the
same memory -- probed first, including that writes through the original are
visible and that the empty case is safe.

Modules are now real. Rust keeps lower::decode and mixed::decode apart by
module, and flattening merged them -- they are different functions, so this
was a miscompile waiting to happen, not a cosmetic issue. The first input is
the crate root, each later one is a module named by its file stem, items are
emitted as <module>_<name>, and a call resolves through an explicit
qualifier, then the current module, then what `use` brought into scope, then
the root.

Three bugs found while getting there: a window alias re-evaluated its offset
and length expression at each use site, so a loop pattern that shadowed a
name silently changed what those bounds meant -- they are now hoisted and
computed once, as Rust computes them once; windows did not compose, so a
chunks_exact_mut over a get_mut view rebuilt the outer view instead of
indexing through it; and `?` now applies a crate's `impl From` to convert the
error type instead of refusing, while still never assuming the conversion is
the identity.

base16ct's lower.rs and upper.rs now go through byte-for-byte, which makes
four of its six modules. encode_str lowers as written --
`encode(src, dst).map(|r| unsafe { core::str::from_utf8_unchecked(r) })` --
returning a &str view of the bytes just written rather than a copy. Remaining
are display.rs, which needs the formatter to accumulate writes across a loop,
and the alloc half, which now reaches debug_assert_eq!.

32 differential cases and 6 integration tests, all green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>