v4: add admin and merchant authentication

[Phloraxx]

Scope

Ninth stacked PayGate v4 implementation slice. Depends on PR #50.

Implements

• singleton password-only admin authentication service
• Argon2id password hashing with bounded/validated parameters
• initial bootstrap that refuses a second bootstrap
• password replacement that atomically revokes every existing admin session
• opaque 256-bit admin session tokens; SQLite stores SHA-256 token hashes only
• 24-hour default session TTL with revoke/expiry validation
• high-entropy merchant API keys; plaintext is returned only at creation and SQLite stores SHA-256 hashes only
• API-key list/revoke/last-used primitives
• admin session/API key last-used writes are throttled rather than written on every authenticated read
• no username/email, JWT, roles, OAuth or shared relay password

Tests

Covers bootstrap, duplicate bootstrap refusal, valid/invalid password, hashed session storage, session revoke/expiry, password-change invalidation, API-key creation/auth/list/revoke, hashed key storage, input validation and malformed credential-hash handling. Full internal/v4/... unit tests, race tests, vet and diff checks pass locally.

Safety

Still no HTTP route registration or production runtime wiring. Merchant API keys, admin sessions and relay device credentials remain separate security domains.