spring-rts-0001: CWeapon::HasIncomingProjectile std::find on vector O(I)
called from InterceptHandler::Update() O(W*P) nested loop = O(W*P*I).
Fix: std::unordered_set<int> for O(1) lookup. 3x measured at W=10 P=200 I=100.
spring-rts-0002: GameServer logs passwords verbatim (CWE-312).
Two LOG() calls in adduser command handler emit pwd.c_str() to log output.
Fix: remove password values from log format strings.
MOAD-0002 (intertangle): pervasive global state (gs, gu, handlers) but
architectural, not patchable per-defect.
MOAD-0003 (leaked context): thread_local in Threading.cpp is infrastructure,
not request-scoped identity. CLEAN.
MOAD-0004: spring-rts-0002 covers this.
MOAD-0005 (thundering herd): simulation is single-threaded for determinism.
No unsynchronized cache patterns. CLEAN.
