feat(security): comprehensive security hardening for tunnel and core services

[Ravandevil25]

Description

This pull request addresses several critical security vulnerabilities and architectural gaps discovered during a comprehensive security audit of the repository.

Key Changes

• CLI Security: Increased the entropy of projectId from 4 bytes (8 hexadecimal characters) to 16 bytes (32 hexadecimal characters). The previous 8-character string was susceptible to enumeration and brute-force discovery attacks on active tunnels.
• Mobile Secure Storage: Migrated sensitive stores (auth.store.ts and connection.store.ts) from React Native's unencrypted AsyncStorage to expo-secure-store. This mitigates the risk of plaintext token extraction by malicious applications or physical device access.
• Tunnel Server DDoS Mitigation: Implemented request rate limiting in the tunnel proxy (proxy.ts) based on active projectId. This prevents malicious actors from launching Denial-of-Service (DDoS) attacks against users' local machines by indiscriminately flooding the dumb-pipe proxy endpoint.

These patches adhere to the existing architectural design while significantly elevating the overall security posture and stability of the platform.

Testing Instructions

1. Ensure the CLI successfully generates 32-character Project IDs in ~/.crosscode/config.json.
2. Verify the Expo app correctly compiles and retains user sessions via the OS-level keystore (SecureStore).
3. Confirm the tunnel server correctly proxies valid requests and rejects floods with HTTP 429 status codes.

[snhsish]

Commit a28d601

• packages/tunnel-server/src/proxy.ts: rate limit key changed from projectId to projectId:clientIp (stops attackers from getting victims 429-blocked); added stale-entry eviction with 10k key cap (unbounded Map leak); Retry-After now reflects actual window remainder instead of hardcoded 60.
• apps/mobile/lib/secure-storage.ts: added isAvailableAsync() gate with AsyncStorage fallback (SecureStore is native-only, PR would have broken web builds); getItem lazily migrates legacy plaintext values into SecureStore then purges them; setItem/removeItem clear AsyncStorage residue so old tokens aren't left extractable.
  apps/mobile/store/connection.store.ts: added partialize stripping ephemeral healthy probe state from persistence (was rewriting the keystore on every health poll and pushing toward the ~2KB SecureStore value cap).

[snhsish]

Reviewed