If a config still has the legacy [system] arm_pin_hash set but no [security] pin_hash, load_config logs a WARNING telling the operator to re-run 'vigilar config set-pin'. The legacy field is still parsed (so old configs don't fail validation) but ignored at runtime. Part of issue #2 PIN hashing unification.