security: Fix 10 vulnerabilities, remove 12 dead code instances

Critical fixes:
- Remove hardcoded admin/admin123 credentials from UserManager
- Enable JWT signature verification (was disabled for debugging)
- Redact secrets from /dev/config endpoint (was exposing os.environ)
- Remove hardcoded SSH admin/admin credentials from hardware service
- Add channel validation to prevent command injection in router interface

Rust fixes:
- Replace partial_cmp().unwrap() with .unwrap_or(Equal) to prevent
  NaN panics in 6 locations across core, signal, nn, mat crates
- Replace .expect()/.unwrap() with safe fallbacks in utils, csi_receiver
- Replace SystemTime unwrap with unwrap_or_default

Dead code removed:
- Duplicate imports (CORSMiddleware, os, Path, ABC, subprocess)
- Unused AdaptiveRateLimit/RateLimitStorage/RedisRateLimitStorage (~110 lines)
- Unused _log_authentication_event method
- Unused Confidence::new_unchecked in Rust
- Fix bare except: clause to except Exception:

https://claude.ai/code/session_01Ki7pvEZtJDvqJkmyn6B714

v1/src/api/middleware/auth.py

@@ -220,27 +220,8 @@ class AuthMiddleware(BaseHTTPMiddleware):
         except Exception as e:
             raise ValueError(f"Token verification error: {e}")
     
-    def _log_authentication_event(self, request: Request, event_type: str, details: Dict[str, Any] = None):
-        """Log authentication events for security monitoring."""
-        client_ip = request.client.host if request.client else "unknown"
-        user_agent = request.headers.get("user-agent", "unknown")
-        
-        log_data = {
-            "event_type": event_type,
-            "timestamp": datetime.utcnow().isoformat(),
-            "client_ip": client_ip,
-            "user_agent": user_agent,
-            "path": request.url.path,
-            "method": request.method
-        }
-        
-        if details:
-            log_data.update(details)
-        
-        if event_type in ["authentication_failed", "token_expired", "invalid_token"]:
-            logger.warning(f"Auth event: {log_data}")
-        else:
-            logger.info(f"Auth event: {log_data}")
+    # TODO: Wire up authentication event logging in dispatch() for
+    # security monitoring (login failures, token expiry, etc.).
 
 
 class TokenBlacklist: