fix: security hardening phase 2

- CORS fail-closed on mainnet (reject startup if ALLOWED_ORIGINS empty)
- Remove query-token fallback in session validate (header-only auth)
- Deprecate memo-based session opening, require session_request_id
- HMAC-SHA256 blind index with startup migration
- HashMap invoice matching for O(1) address lookup
- CipherScan circuit breaker with 30s cooldown
- Parallel block fetching (batches of 10)
- X-CipherPay-Delivery-Id header on all webhooks
- Cache-Control: private, no-store on API responses
- Skip dust fees below 25000 zatoshis
- Remove unused spawn_webhook function
- Add cargo audit CI workflow

Author: Kenbak

.cargo-home/.crates.toml

@@ -0,0 +1,3 @@
+Signature: 8a477f597d28d172789f06886806bc55
+# This file is a cache directory tag created by cargo.
+# For information about cache directory tags see https://bford.info/cachedir/