Security stack is production-hardened:
- Real cryptography (no placeholders)
- Multi-layer authentication (password + TOTP + MFA)
- Session security (idle timeout + audit)
- Administrator accountability (separate admin log)
- Time integrity (NTP verification on startup)