Audit password KDF settings against OWASP 2026 minimums (Argon2id or PBKDF2-HMAC-SHA256 >= 600,000 iterations + 16-byte salt).