refactor: extract SHA3 hashing utilities to utils/hash.go

- Move all SHA3-512 hashing functions to utils package
- Update import statements and function calls
- Maintain zero functional changes
- First step in systematic main.go refactoring

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

main.go

@@ -27,8 +27,9 @@ import (
 	"github.com/klauspost/compress/zstd"
 	"github.com/robfig/cron/v3"
 	"github.com/sirupsen/logrus"
-	"golang.org/x/crypto/sha3"
 	"gopkg.in/yaml.v3"
+
+	"kvs/utils"
 )
 
 // Core data structures
@@ -329,24 +330,6 @@ type Server struct {
 	backupMu      sync.RWMutex   // Protects backup status
 }
 
-// SHA3-512 hashing utilities for Phase 2 authentication
-func hashSHA3512(input string) string {
-	hasher := sha3.New512()
-	hasher.Write([]byte(input))
-	return hex.EncodeToString(hasher.Sum(nil))
-}
-
-func hashUserNickname(nickname string) string {
-	return hashSHA3512(nickname)
-}
-
-func hashGroupName(groupname string) string {
-	return hashSHA3512(groupname)
-}
-
-func hashToken(token string) string {
-	return hashSHA3512(token)
-}
 
 // Phase 2: Storage key generation utilities
 func userStorageKey(userUUID string) string {
@@ -488,7 +471,7 @@ func validateJWT(tokenString string) (*JWTClaims, error) {
 
 // storeAPIToken stores an API token in BadgerDB with TTL
 func (s *Server) storeAPIToken(tokenString string, userUUID string, scopes []string, expiresAt int64) error {
-	tokenHash := hashToken(tokenString)
+	tokenHash := utils.HashToken(tokenString)
 	
 	apiToken := APIToken{
 		TokenHash: tokenHash,
@@ -598,7 +581,7 @@ func (s *Server) authenticateRequest(r *http.Request) (*AuthContext, error) {
 	}
 
 	// Verify token exists in our database (not revoked)
-	tokenHash := hashToken(tokenString)
+	tokenHash := utils.HashToken(tokenString)
 	_, err = s.getAPIToken(tokenHash)
 	if err == badger.ErrKeyNotFound {
 		return nil, fmt.Errorf("token not found or revoked")
@@ -1152,7 +1135,7 @@ func getMerkleLogKey(timestamp string) string {
 func generateLogSignature(timestamp, action, userUUID, resource string) string {
 	// Concatenate all fields in a deterministic order
 	data := fmt.Sprintf("%s|%s|%s|%s", timestamp, action, userUUID, resource)
-	return hashSHA3512(data)
+	return utils.HashSHA3512(data)
 }
 
 // isActionLogged checks if a specific action should be logged
@@ -2771,7 +2754,7 @@ func (s *Server) createUserHandler(w http.ResponseWriter, r *http.Request) {
 
 	user := User{
 		UUID:         userUUID,
-		NicknameHash: hashUserNickname(req.Nickname),
+		NicknameHash: utils.HashUserNickname(req.Nickname),
 		Groups:       []string{},
 		CreatedAt:    now,
 		UpdatedAt:    now,
@@ -2883,7 +2866,7 @@ func (s *Server) updateUserHandler(w http.ResponseWriter, r *http.Request) {
 		user.UpdatedAt = now
 
 		if req.Nickname != "" {
-			user.NicknameHash = hashUserNickname(req.Nickname)
+			user.NicknameHash = utils.HashUserNickname(req.Nickname)
 		}
 
 		if req.Groups != nil {
@@ -2971,7 +2954,7 @@ func (s *Server) createGroupHandler(w http.ResponseWriter, r *http.Request) {
 
 	group := Group{
 		UUID:      groupUUID,
-		NameHash:  hashGroupName(req.Groupname),
+		NameHash:  utils.HashGroupName(req.Groupname),
 		Members:   req.Members,
 		CreatedAt: now,
 		UpdatedAt: now,