security: implement quick win remediations (FLOOD-001, CLI-002, CLI-003, AUDIT-001)

FLOOD-001: Cap anti-flood request list at configurable max entries
- Add ANTIFLOOD_MAX_ENTRIES config (default 10000)
- Prune oldest entries when limit exceeded

CLI-002: Explicitly set SSL hostname verification
- Add ctx.check_hostname = True and ctx.verify_mode = CERT_REQUIRED
- Defense in depth (create_default_context sets these by default)

CLI-003: Warn on insecure config file permissions
- Check if config file is world-readable
- Print warning to stderr if permissions too open

AUDIT-001: Already implemented - query has LIMIT/OFFSET with 500 max

PENTEST_PLAN.md

@@ -251,16 +251,16 @@ Testing uses specialized Claude subagents for different security domains, with f
 ### Medium-term (Medium)
 
 - [ ] **HASH-001**: Add locking to content hash deduplication
-- [ ] **FLOOD-001**: Add memory limit to anti-flood request list
+- [x] **FLOOD-001**: Add memory limit to anti-flood request list
 - [ ] **ENUM-001**: Add rate limiting to paste metadata endpoints
-- [ ] **CLI-002**: Verify SSL certificate hostname matching
-- [ ] **CLI-003**: Add config file permission validation on startup
+- [x] **CLI-002**: Verify SSL certificate hostname matching
+- [x] **CLI-003**: Add config file permission validation on startup
+- [x] **AUDIT-001**: Add query result limits to prevent enumeration
 
 ### Long-term (Low)
 
 - [ ] **CRYPTO-001**: Add certificate serial collision detection
 - [ ] **TIMING-001**: Add constant-time database lookups for sensitive queries
-- [ ] **AUDIT-001**: Add query result limits to prevent enumeration
 
 ---