security: replace SHA-256 with PBKDF2-HMAC-SHA256 for key derivation

- scripts/utils/keystore.py: use PBKDF2 with 100,000 iterations
- cli/keystore_auth.py: use PBKDF2 with 100,000 iterations
- cli/aitbc_cli.py: use PBKDF2 with 100,000 iterations
- apps/agent-coordinator/scripts/agent_daemon.py: use PBKDF2 with 100,000 iterations

Fixes 4/25 CodeQL alerts related to weak cryptographic hashing.
Note: cli/utils/__init__.py already uses Argon2 which is more secure.

cli/aitbc_cli.py

@@ -77,8 +77,8 @@ def decrypt_private_key(keystore_path: Path, password: str) -> str:
             # Fallback for older format
             salt = bytes.fromhex(kdfparams.get('salt', ''))
         
-        # Simple KDF: hash(password + salt) - matches scripts/utils/keystore.py
-        dk = hashlib.sha256(password.encode() + salt).digest()
+        # Use PBKDF2 for secure key derivation (100,000 iterations for security)
+        dk = hashlib.pbkdf2_hmac('sha256', password.encode(), salt, 100000, dklen=32)
         fernet_key = base64.urlsafe_b64encode(dk)
         
         f = Fernet(fernet_key)

cli/keystore_auth.py

@@ -17,11 +17,12 @@ from cryptography.fernet import Fernet
 
 
 def derive_key(password: str, salt: bytes = b"") -> tuple[bytes, bytes]:
-    """Derive a 32-byte key from the password using SHA-256."""
+    """Derive a 32-byte key from the password using PBKDF2-HMAC-SHA256."""
     if not salt:
         import secrets
         salt = secrets.token_bytes(16)
-    dk = hashlib.sha256(password.encode() + salt).digest()
+    # Use PBKDF2 for secure key derivation (100,000 iterations for security)
+    dk = hashlib.pbkdf2_hmac('sha256', password.encode(), salt, 100000, dklen=32)
     return base64.urlsafe_b64encode(dk), salt