fix: address high-severity security issues from review

- Use subtle.ConstantTimeCompare for static credential checks to
  prevent timing side-channel attacks
- Cap failCounts (100k) and rememberedCreds (10k) maps with eviction
  to prevent memory exhaustion from botnet-scale scanning
- Sweep expired credentials on each auth attempt
- Add configurable max_connections (default 500) with semaphore to
  limit concurrent connections and prevent goroutine/fd exhaustion

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/config/config.go

@@ -15,8 +15,9 @@ type Config struct {
 }
 
 type SSHConfig struct {
-	ListenAddr  string `toml:"listen_addr"`
-	HostKeyPath string `toml:"host_key_path"`
+	ListenAddr     string `toml:"listen_addr"`
+	HostKeyPath    string `toml:"host_key_path"`
+	MaxConnections int    `toml:"max_connections"`
 }
 
 type AuthConfig struct {
@@ -60,6 +61,9 @@ func applyDefaults(cfg *Config) {
 	if cfg.SSH.HostKeyPath == "" {
 		cfg.SSH.HostKeyPath = "oubliette_host_key"
 	}
+	if cfg.SSH.MaxConnections == 0 {
+		cfg.SSH.MaxConnections = 500
+	}
 	if cfg.Auth.AcceptAfter == 0 {
 		cfg.Auth.AcceptAfter = 10
 	}