Reset version to 1.0.0 and add TODO/CHANGELOG

Reset all Path A script versions from 3.x to 1.0.0 following architectural
decision to treat this as a fresh stable baseline after the Path B cleanup.
Added TODO.md with prioritized audit findings and replaced the old CHANGELOG
with a clean stub.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

lib/security.sh

@@ -2,7 +2,7 @@
 
 # HOPS - Security Functions
 # Password generation, validation, and security utilities
-# Version: 3.2.0
+# Version: 1.0.0
 
 # Source common functions
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"