v0.24.0 — hashing + encryption

Auth foundations, edge-safe via Web Crypto (no bcrypt to compile):

const hashed = await hash.make(password);
await hash.verify(hashed, password);           // timing-safe

const token = await encryption.encrypt({ userId: 1 });
await encryption.decrypt(token);                // { userId: 1 } | null

Hashing is PBKDF2-SHA256 (self-describing, with needsRehash()); encryption is AES-GCM keyed by config('app.key'), returning null on tampered payloads. See docs/hashing.md.