security: fix DUMMY_HASH, timing jitter, and sub-token scan limit

[mosobande]

• Replace invalid 36-char DUMMY_HASH with valid 60-char BCrypt hash to
  prevent user enumeration via timing side-channel
• Replace fixed 100ms Thread.sleep floor with randomized 80-120ms jitter
  to improve timing normalization and reduce thread exhaustion risk
• Limit sub-token validation fallback scan to maxClients entries to
  bound worst-case BCrypt comparisons
• Remove SECURITY-AUDIT.md
• Update security and performance docs to reflect changes