Generate security review questions for PRs touching auth or payments

PR modifies authentication logic. Need security checklist: 'Does this prevent brute force?', 'Are passwords hashed?', 'Is rate limiting applied?'. Don't assume security is handled.