fix: address high-severity security issues from review

- Use subtle.ConstantTimeCompare for static credential checks to
  prevent timing side-channel attacks
- Cap failCounts (100k) and rememberedCreds (10k) maps with eviction
  to prevent memory exhaustion from botnet-scale scanning
- Sweep expired credentials on each auth attempt
- Add configurable max_connections (default 500) with semaphore to
  limit concurrent connections and prevent goroutine/fd exhaustion

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/server/server_test.go

@@ -97,8 +97,9 @@ func TestIntegrationSSHConnect(t *testing.T) {
 	tmpDir := t.TempDir()
 	cfg := config.Config{
 		SSH: config.SSHConfig{
-			ListenAddr:  "127.0.0.1:0",
-			HostKeyPath: filepath.Join(tmpDir, "host_key"),
+			ListenAddr:     "127.0.0.1:0",
+			HostKeyPath:    filepath.Join(tmpDir, "host_key"),
+			MaxConnections: 100,
 		},
 		Auth: config.AuthConfig{
 			AcceptAfter:       2,