fix(app): 503 on storage failures, validated currency, lock release on shutdown, per-IP login limit, unit-only npm test

fix(auth): bound scrypt params, cap concurrency, evict rate-limit keys, re-bootstrap admin

feat(auth): add scrypt hashing, signed session tokens and rate limiter