fix(ui): shared safe-next validation, no lockout on success, logout origin check, tab/feed polish

fix(auth): bound scrypt params, cap concurrency, evict rate-limit keys, re-bootstrap admin

feat(auth): add scrypt hashing, signed session tokens and rate limiter