fix: implement 22 security pentest remediation fixes

Server-side session management with SHA-256 hashed tokens and HttpOnly
cookies. Auth middleware gating all RPC/WS/proxy routes with method
allowlist. Login rate limiting (5/60s per IP). CORS restricted to
config origin. Docker registry allowlist. App ID and path validation.
P2P message sanitization (HTML + log injection). Onion address and
known-peer validation. Nginx security headers (CSP, X-Frame-Options,
etc.) and AIUI proxy auth. Systemd hardening (non-root, NoNewPrivileges,
ProtectSystem).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

core/archipelago/Cargo.toml

@@ -41,7 +41,9 @@ archipelago-parmanode = { path = "../parmanode" }
 
 # Authentication
 bcrypt = "0.15"
+sha2 = "0.10"
 uuid = { version = "1.0", features = ["v4"] }
+regex = "1.10"
 
 # Node identity (Ed25519)
 ed25519-dalek = { version = "2.1", features = ["rand_core"] }