Phase 11: Add SHA-256 prefix index for token lookup at scale

[alahdal262]

Context

In Phase 10, authenticateProjectToken performs an O(n) scan over all projects, verifying the token against each Argon2id hash with constant-time comparison. This is correct and secure, but does not scale beyond ~100 projects.

Requirements

• Store a SHA-256 hash of each plaintext token in a new indexed column (tokenPrefix) on the Project model
• On auth, compute SHA-256 of the incoming token and look up the candidate project by prefix (O(1) index lookup)
• Then verify the full token against the Argon2id hash (single comparison instead of N)
• Migration must backfill existing tokens (requires re-hashing from plaintext during provisioning)

Acceptance Criteria

• Project model has a tokenPrefix column with a unique index
• authenticateProjectToken uses SHA-256 prefix for O(1) lookup
• Full Argon2id verification still runs after prefix match
• Provisioning endpoint stores both Argon2id hash and SHA-256 prefix