Fix the password hashing audit for stored credentials

An AI wrote a password hashing helper with hashlib.md5(pw + SECRET_SALT): a fast hash, and one salt for every user, written into the source. It produced a hash, so it looked done. Your team now audits every password hashing setup against current practice before it ships.

An assistant wrote audit_password_hashing(algorithm, salt_source, work_factor). It is in the editor. It has a bug. Find it and fix it.

Input and output:

• algorithm: the name of the hash or KDF. A KDF (key derivation function) is a hash built to be slow, which is what passwords need.
• salt_source: where the salt comes from: none, hardcoded_constant, global_env or per_password_random.
• work_factor: the cost setting, in the algorithm's own units.
• Return the findings, without repeats, sorted by plain character order.

Rules the tests check:

• Trim whitespace from algorithm and salt_source, then lowercase them.
• md5, sha1, sha256 and sha512 are fast hashes: "fast_hash". bcrypt, scrypt, pbkdf2, argon2 and argon2id are KDFs. Any other algorithm: "unknown_algorithm".
• Salt none: "missing_salt". hardcoded_constant: both "hardcoded_salt" and "shared_salt". global_env: "shared_salt", since one value serves every user. per_password_random: no finding. Any other value: "unknown_salt_source".
• For a KDF only, add "low_work_factor" when work_factor is below its minimum: 12 for bcrypt, 16384 for scrypt, 600000 for pbkdf2, and 2 for argon2 and argon2id.