[MEDIUM] HKDF used instead of PBKDF2 for password-based key derivation

[Danieliushka]

HKDF in _deriveKeyFromPassword (src/lib/crypto/private-key-manager.js line ~165) has no iteration count — vulnerable to brute-force on exported key backups. Use PBKDF2 (already in MasterKeyDerivation) or Argon2id.