Story: Clean ores.security to the component clean standard

ores.security meets the Component Clean Standard: the items marked All pass, each item that does not apply is recorded with its reason, and ores.security joins COMPONENTS_UNDER_TEST. Order 7 of 35 in the sprint 26 component clean-up, tier 1 (foundation infrastructure).

• Every checklist item that applies to a component of kind All passes, with its evidence recorded on the task.
• Every item that does not apply is recorded as not applicable, with the reason.
• Every generator defect found is fixed at its source, with a regression test.
• ores.security is listed in COMPONENTS_UNDER_TEST, and check_component_drift.py --all passes.

• Survey on 2026-09-23: 0 entity, junction or operation models; 16 C++ files outside tests, 0 of them generated (0%); 0 messaging headers, 0 of them hand-written.
• Survey on 2026-09-25, by an agent that did not write the component. 16 production C++ files in 11 headers and 5 sources, 6 files under `tests/`, 55 test cases, 127 assertions, and 448 files outside the component include it. The suite passes. `crypto/encryption.cpp` has no consumer at all, `password_hasher.hpp` declares two functions that are never defined, and one error enumerator is never produced. The test gaps carry more weight here than elsewhere, because the code is cryptographic. They are listed on the task.
• Keep the component. It is the repo's only home for hashing, JWTs and the OWASP validators.
• Outcome, 2026-09-26. All ten work items landed. The component lost three files and 432 lines, and its suite went from 127 assertions in 55 test cases to 149 in 57. Two defects the survey did not name turned up while writing the tests: the error codes the enum declares had no producer, and the allow-expired path skipped the audience check the strict path applies. Both are fixed with a test per case. `encryption` is deleted rather than kept unused, `nbf` cannot be tested because nothing sets it, and the survey's `missing_claims` proposal was the wrong fix for the real defect.
• Correction, 2026-09-26. The first cut deleted `ores.security.hpp` as a consumer-less stub. Every component keeps its namespace documentation header, so it is restored with its claims corrected, and the standard now says so as G08. The same mistake on the `ores.utility` pass, where eleven namespace headers were deleted, is corrected in a follow-up.

• Decide `crypto/encryption.cpp` first. It has no consumer and no failure-path test. Either name a consumer and test it properly, or delete it with its test. Several of the gaps below go with it. Recorded as item B06 of the standard.
• Reject a downgraded scrypt cost at verify. `password_hasher.cpp` accepts any `ln` from 1 to 31, and `ln=1` is 8192 times weaker than the production factor. The test that forbids it is part of this story.
• Pin the stored hash format and the cost parameter in a test. The suite runs with `ORES_TEST_PASSWORD_FAST=1`, so the production factor is never exercised today.
• Prefer the standard facility over a hand-rolled shim. Recorded as item H04.

• The other 145 stale `component_files.cmake` files, which are one repo-wide sweep. This story fixes only security's two.
• The registry gap. security has no catalogue row and no model, so it cannot join `COMPONENTS_UNDER_TEST`.