feat(node): share all security state through Redis - #46

Summary

• share PoW challenges and atomic claims across Node replicas
• atomically claim tokens and share Siteverify idempotency responses
• share rate limits, suspicion, bounded fingerprint cardinality, and site-key rotation guards
• use the same privacy-safe Redis namespace and TTL model as Go
• fail closed when Redis cannot enforce a security boundary
• preserve the synchronous library API and in-memory default
• update README and installation capability notes

Stack

Depends on #45. Retarget to main after #45 merges.

Validation

• npm test
• live Node server: 12/12 cross-server conformance checks