Raise mul's OpenSSL routing threshold to match a Control4 controller

[derek-miller]

Measured on the dev controller (2026-10-18: arm64, LuaJIT 2.1.1700206165, lua-openssl 0.8.5) inside a driver with jit="1" (LuaJIT's JIT on). The figures are pure-Lua time over OpenSSL time, conversions included:

call (24-bit limbs)	JIT on	JIT off
mul 16x16 / 22x22 (SRP's u*x)	0.34x / 0.38x	1.60x / 2.18x
mul 48x48 / 64x64 / 128x128	0.94x / 1.30x / 2.39x	– / – / 14.69x
mul 24x128	1.04x	–
divmod 40/20 / 256/128	1.26x / 7.94x	2.07x / –
mod_mul 8,8,8 / SRP's k*v	1.06x / 3.97x	1.89x / –

With the JIT on, divmod, mod and mod_mul win at the current threshold of 4 limb products per converted limb, but mul breaks even near 12. So mul now routes at MUL_ROUTE_MIN_RATIO (12); the others keep ROUTE_MIN_RATIO (4). Without the JIT this gives up at most a few tenths of a millisecond per mid-size multiply.

The same session measured pure-Lua mod_exp on the controller:

• JIT on: 21 ms + 1.34 ms per exponent bit.
• JIT off: 65 ms + 15.5 ms per bit.
• bn.powmod: 5.13 ms (256-bit exponent) and 60.97 ms (full width), matching the old record.

The old pure-Lua figure (669 ms per bit, 2026-08-07) doesn't reproduce with the current code in either mode. A Pair-Setup exchange is about 2.5 s in pure Lua with the JIT and about 28 s without, against about 0.04 s through OpenSSL, not minutes. CLAUDE.md, srp.is_accelerated's doc, bignum.is_accelerated's doc and the README now say so. SRP still needs OpenSSL on Control4: seconds of serialised Lua stall every driver.

Tests: the mul routing boundary moves to 47x48 (not routed) and 48x48 (exactly 12). The signed-hex test now uses a multiply wide enough to route; removing the hex guard still fails it. make check, plus bignum and srp suites on LuaJIT with and without the 0.8.5 rock, Lua 5.4 with it, and Lua 5.5.

Second commit: trims the routing comments to the deciding numbers and drops references to any particular consumer of the library.

[svc-finitelabs]

Approving. Checked at cde0f32:

• Boundary arithmetic. 47x48 is 2256 products for 190 limbs converted, under 12 x 190 = 2280. 48x48 is 2304 for 192, exactly 12. The widened signed-hex operand is 30 limbs against N's 128: 3840 products against 12 x 316 = 3792, so it routes. N times it is 944 hex digits, and 944 mod 6 = 2, so the "-" still shares a chunk.
• Mutations. I tried four. Ratio 11 fails shape 4, and ratio 13 fails shape 5 and the signed-hex test. Pointing mul back at ROUTE_MIN_RATIO fails shape 4. Dropping the ^%x+$ guard fails only the signed-hex test. The unmutated control passes.
• Doc figures. These follow from the fits: 21 + 1.34 x 256 = 0.36 s, x 3072 = 4.1 s. With the JIT off, 4.0 s and 48 s. The exponent bits in Pair-Setup add up to about 1792 (256 + 512 + 1024), which gives 2.46 s with the JIT on, 28.0 s off, and about 0.04 s at 0.02 ms per bit through bn.powmod (60.97 / 3072).
• Tests. bignum and srp pass locally on LuaJIT and Lua 5.5 without the rock. The full CI matrix, including the 0.8.5 job, is green.

Two optional nits, neither blocking:

• bignum.is_accelerated's doc cites mod_mul at "3.6 ms in pure Lua against 0.28 ms" per 3072-bit call. That is about 13x, but the new table has no 128,128,128 row, so nothing in the file backs that figure. Adding the row would fix that.
• srp.lua:403 still says "rather than discovering it by hanging". After this PR's wording that reads like the old minutes-long figure. "by stalling" would match.

[svc-finitelabs]

Re-reviewed at a953786. The new commit only changes comments and markdown, with no code or test changes. The trimmed text still matches the measurements: the JIT-on case is the one that favours pure Lua most, which justifies the ratios without pointing at any consumer. Nothing references the dropped table any more, and the is_accelerated doc no longer quotes the mod_mul figure that had no table row. Full CI matrix is green at this head, including lua-openssl 0.8.5.