Security & hardening pass: scrypt password hashing, persisted admin sessions, upvote/analytics rate limits, dependency fixes, healthcheck, lint cleanup; v2.10.0

- Study passwords: salted scrypt; legacy SHA-256 hashes verified and upgraded on login
- Admin sessions persisted (hashed tokens) so deploys no longer log the admin out
- Upvotes: rate limit + one per client per question, approved questions only; rate limit on analytics play/event
- npm audit: 46 -> 4 vulnerabilities (tiptap bumped to 3.31.4)
- Untrack per-user data (study users/notes/progress/etc.) from git
- Dockerfile HEALTHCHECK; node --test suite for password hashing
- Fix email template cards remounting (lost input focus) on each keystroke
- Lint: 34 errors -> 0

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.gitignore

@@ -42,3 +42,16 @@ data/study-sessions.json
 *.njsproj
 *.sln
 *.sw?
+
+# Persisted admin sessions (hashed tokens)
+data/admin-sessions.json
+
+# Per-user / visitor data — lives only in the server's data volume, never in git
+data/study-users.json
+data/study-notes/
+data/study-progress/
+data/study-reminders.json
+data/study-community.json
+data/analytics-events.json
+data/admin-reply-history.json
+data/episode-plays.json