Security — account protection for aerospace teams

• PBKDF2-SHA256 password hashing. Passwords are never emailed or logged.
• Session tokens are stored as SHA-256 hashes and can be revoked.
• Admin login requires email, password and a rotating server-side token.
• S3 buckets stay private. Prefer IAM roles on EC2.