You say "the code recurses a sha256 computation 1714 times to get a password for decryption, and then once more to get the lookup key", however in the code above the search string is computed as var search = sha256(key);, note it's using key and not passkey, which means, assuming that is correct, only one round of sha256, so roughly 1715 times faster to crack.

It seems weird that the sensitive part (ID number + birth date + post code) would be encrypted the most weakly, and the public part (voting station) would be encrypted the most strongly. Maybe I'm reading this wrong or the code author involuntarily made his encryption quite weaker.