L3/SEC-008: replace SHA-1 with SHA-256 for card fingerprint; note HIBP SHA-1 contract

@@ -178,6 +178,8 @@178178 // ---------------------------------------------------------------------------179179 180180 export async function checkBreach(password: string): Promise<number> {181+  // HIBP k-anonymity API is keyed on SHA-1 prefixes — this is dictated by182+  // the public API, not a security choice. Do not migrate to SHA-256 here.181183   const encoder = new TextEncoder();182184   const hashBuffer = await crypto.subtle.digest("SHA-1", encoder.encode(password));183185   const hashHex = Array.from(new Uint8Array(hashBuffer))@@ -217,8 +219,10 @@217219 218220 async function cardFingerprint(last4: string, expMonth: string, expYear: string): Promise<string> {219221   const encoder = new TextEncoder();220-  const buf = await crypto.subtle.digest("SHA-1", encoder.encode(`${last4}${expMonth}${expYear}`));221-  return Array.from(new Uint8Array(buf)).map(b => b.toString(16).padStart(2, "0")).join("");222+  const buf = await crypto.subtle.digest("SHA-256", encoder.encode(`${last4}|${expMonth}|${expYear}`));223+  return Array.from(new Uint8Array(buf).slice(0, 8))224+    .map((b) => b.toString(16).padStart(2, "0"))225+    .join("");222226 }223227 224228 function hex(buf: Uint8Array): string {