refactor: replace risky hashing functions with secure PHP hashing APIs

[deepsource-dev-autofix]

This PR refactors all instances of insecure or custom hashing (MD5 and manual HMAC loops) and replaces them with PHP’s built-in, secure hashing functions. It standardizes password storage using password_hash()/password_verify(), upgrades old hashes automatically with password_needs_rehash(), and switches non-password tokens to SHA-256.

Changes include:

• Broken or Risky Hashing Function: The code originally used MD5 (and manual MD5 loops) for password storage, API keys, random states, and HMAC operations—methods that are vulnerable to collisions and brute-force attacks. We replaced password hashes with password_hash($password, PASSWORD_DEFAULT) and verification via password_verify(), added password_needs_rehash() to transparently migrate old hashes, and removed all custom MD5-based routines. For non-password tokens, we now use hash('sha256', ...) and pack() accordingly.

Security configuration:

• We rely on PASSWORD_DEFAULT for password hashing, which currently maps to bcrypt (and may change to a stronger algorithm in future PHP versions). No explicit cost parameter was set, so PHP’s default cost is used (assumed to be appropriate for most environments). Please review and adjust the algorithm or cost settings in your PHP configuration or this code if you have specific performance or security requirements.

This Autofix was generated by AI. Please review the change before merging.