docs(security): explain SHA-256 cache-key rationale in inner-ai

The tokenCacheKey() SHA-256 digest is an in-memory cache key derived from
the session token, not password-at-rest storage. Document why CWE-916 KDFs
(bcrypt/scrypt/Argon2) are inapplicable here so the CodeQL
js/insufficient-password-hash finding (code-scanning alert 261) is correctly
understood as a false positive.

open-sse/executors/inner-ai.ts

@@ -61,6 +61,12 @@ function lruSet<V>(map: Map<string, V>, key: string, value: V): void {
   }
 }
 
+// SHA-256 here derives an in-memory cache key from the session token — it is NOT
+// password-at-rest storage. The slow KDFs CWE-916 recommends (bcrypt/scrypt/Argon2)
+// are salted and non-deterministic, so they cannot be used as a stable Map key and
+// would defeat the cache entirely. CodeQL js/insufficient-password-hash flags this as
+// a false positive (dismissed); a fast cryptographic digest is the correct primitive
+// for keying an ephemeral, process-local cache.
 function tokenCacheKey(token: string): string {
   return createHash("sha256").update(token).digest("hex");
 }