feat: add combipow passphrase attack (#88)

Add menu option 21 (Combipow Passphrase Attack) using combipow.bin from
hashcat-utils. Generates all unique non-empty subset combinations from a
short wordlist and pipes them into hashcat stdin.

- hcatCombipow(hash_type, hash_file, wordlist, use_space_sep) in main.py
- combipow_crack handler in attacks.py validates file, enforces 63-line
  limit, prompts for space separator, then delegates to hcatCombipow
- Wired into get_main_menu_items() and get_main_menu_options() in both
  main.py and hate_crack.py
- 12 tests covering menu presence, handler delegation, line-count
  enforcement, file validation, and subprocess flag construction

README.md

@@ -618,6 +618,7 @@ All tests use mocked API calls, so they can run without connectivity to a Hashvi
   (16) OMEN Attack
   (17) Ad-hoc Mask Attack
   (18) Markov Brute Force Attack
+  (21) Combipow Passphrase Attack
 
   (90) Download rules from Hashmob.net
   (91) Analyze Hashcat Rules
@@ -789,6 +790,15 @@ Generates password candidates using Markov chain statistical models. Similar to
 * Markov table persists with hash file (filename.out.hcstat2) for fast subsequent runs
 * Faster than OMEN for general-purpose brute forcing
 
+#### Combipow Passphrase Attack
+Generates all unique non-empty subset combinations from a short wordlist using `combipow.bin` and pipes them into hashcat. Designed for passphrase cracking when you know the pool of words a password was built from.
+
+* Prompts for a wordlist file (max 63 lines - combipow generates up to 2^n-1 combinations)
+* Optional space separator (`-s` flag) to insert spaces between words in each combination
+* Warns if the wordlist exceeds 20 lines (output volume may be large)
+* Aborts with a clear message if the wordlist exceeds 63 lines (hard limit)
+* Candidates are piped directly to hashcat stdin
+
 #### Download Rules from Hashmob.net
 Downloads the latest rule files from Hashmob.net's rule repository. These rules are curated and optimized for password cracking and can be used with the Quick Crack and Loopback Attack modes.