Checkpoint: security discipline

Implement static byte[] RandomSalt(int bytes) using RandomNumberGenerator, and static string HashPassword(string password, byte[] salt) returning Base64 of Rfc2898DeriveBytes(Pbkdf2) with 100_000 iterations, SHA256, 32-byte output. Then implement static bool VerifyPassword(string password, byte[] salt, string expectedBase64) that recomputes and compares with CryptographicOperations.FixedTimeEquals (the timing-safe comparison the lesson mandates). The tests prove the work factor matters: hashing must actually take measurable time (100k iterations is >= 10ms on this runtime) — a 1-iteration stub is a vulnerability even when the outputs match.