feat: comprehensive audit fixes, new tests, and production improvements

[BitcoinErrorLog]

Summary

Comprehensive improvements from security audit addressing code quality, testing gaps, and documentation.

Code Quality Fixes

• Fix Clippy errors: needless borrows, unused imports, clone on Copy types
• Add #![allow(unpredictable_function_pointer_comparisons)] for UniFFI macro
• Remove unused INTERNAL_EPOCH constant from mobile_manager
• Add cargo::rustc-check-cfg for loom in build.rs
• Replace vec![] with array literals, fix redundant closures

Security & Documentation

• Expand THREAT_MODEL.md with FFI boundary security section
• Add mobile-specific threat considerations
• Document FFI trust model and error handling

New Test Files

• tests/replay_protection.rs - replay attack prevention tests
• tests/server_policy.rs - server policy configuration tests
• tests/xx_pattern.rs - XX pattern handshake tests
• tests/network_partition.rs - network partition handling tests

Test Improvements

• Enhance loom_tests.rs with stress and race condition tests
• Fix fuzz targets to use 3-step handshake API
• Add missing dependencies to fuzz/Cargo.toml (sha2, zeroize)

Session Manager

• Improve error messages with .expect() for mutex locks

Test plan

• All Clippy warnings resolved
• New test files added for missing test categories
• Fuzz targets compile and work with current API
• THREAT_MODEL.md expanded with FFI security documentation