fix: Use PBKDF2 for secure PIN hashing

[zhifu349-debug]

Summary

Fix insecure PIN hashing using unsalted SHA-256 (issue #20).

Changes

Replace fast unsalted SHA-256 with PBKDF2-HMAC-SHA256:

• Use random 32-byte salt per PIN
• Apply 100,000 iterations for secure key derivation
• Store salt+hash together (base64 encoded)
• Add verification function that extracts salt from stored hash

Security Improvement

Before	After
SHA-256 (no salt)	PBKDF2-HMAC-SHA256
Instant rainbow table attack	~100ms per hash
No salt	Unique random salt per PIN

Testing

Existing PIN functionality should continue to work. New PINs will use the secure hashing scheme.

Fixes

• Issue: Security: Insecure PIN Hashing (Unsalted SHA-256) #20