Hash and verify passwords off the event loop (B-55)

Argon2 is deliberately expensive — tens of milliseconds of CPU per call. Called
inline from the async handlers for register, login, change-password and the
admin reset, that cost froze the entire process for its duration: every other
request, plus all six background tasks (scheduler, confirmation poller, RBF
bumper, listener, both reconcilers). A burst of unauthenticated login attempts
was therefore not just slow logins, it delayed draws and confirmations.

hash_password_async/verify_password_async wrap the existing pair in
run_in_threadpool, and every async caller now uses them. The synchronous
functions stay: they're what the wrappers call, and what tests and scripts (no
running loop) use directly.

The regression test runs a heartbeat task alongside the hashing and counts how
often the loop got to run it — 1 tick with the old inline call, many with the
threadpooled one.

Also drops the running "already fixed and removed" list from BUGS.md: the file
tracks open findings, and `git log --all --grep 'B-nn'` is the record of how a
closed one was closed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app/api/routes/admin.py

@@ -8,7 +8,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.api.timeutil import isoformat_utc
 from app.audit.log import write_audit_log
-from app.auth.security import hash_password
+from app.auth.security import hash_password_async
 from app.config import settings
 from app.db.models import AuditLog, BugReport, PendingTransaction, Round, User
 from app.db.session import get_session
@@ -217,7 +217,7 @@ async def reset_user_password(
         raise HTTPException(status.HTTP_404_NOT_FOUND, "user not found")
 
     new_password = secrets.token_urlsafe(12)
-    user.password_hash = hash_password(new_password)
+    user.password_hash = await hash_password_async(new_password)
     # B-34: this endpoint exists precisely for the "account compromised" case —
     # without bumping token_version, whoever was already logged in (the
     # attacker, if that's who prompted the reset) stayed logged in on their