Security hardening: replace pickle, add PFS, and add guards

[LashSesh]

Summary

• Replace pickle-based payloads with JSON frames, X25519 handshakes, HKDF-derived session keys, and salted Scrypt encryption.
• Enforce replay protection, frame-size limits, socket timeouts, and per-IP rate limiting for inbound peers.
• Add pytest regression coverage, security CI (pytest/bandit/pip-audit), and document the new security posture in SECURITY.md and CHANGELOG.md.

Testing

• pytest

Security Notes

• Fixes: pickle RCE risk, weak SHA-256 password KDF, missing forward secrecy, replay/DoS gaps.
• Remaining recommendations: add authenticated key confirmation with UI fingerprint pinning, integrate persistent session key rotation metrics, extend fuzzing for QR parsing.

Maintainer Checklist

• pip install -r requirements.txt -r requirements-dev.txt
• pytest
• bandit -q -r .
• pip-audit

---

https://chatgpt.com/codex/tasks/task_e_68ec80e632948331871f440b4bf56a68