Hash and verify passwords off the event loop (B-55)

Argon2 is deliberately expensive — tens of milliseconds of CPU per call. Called
inline from the async handlers for register, login, change-password and the
admin reset, that cost froze the entire process for its duration: every other
request, plus all six background tasks (scheduler, confirmation poller, RBF
bumper, listener, both reconcilers). A burst of unauthenticated login attempts
was therefore not just slow logins, it delayed draws and confirmations.

hash_password_async/verify_password_async wrap the existing pair in
run_in_threadpool, and every async caller now uses them. The synchronous
functions stay: they're what the wrappers call, and what tests and scripts (no
running loop) use directly.

The regression test runs a heartbeat task alongside the hashing and counts how
often the loop got to run it — 1 tick with the old inline call, many with the
threadpooled one.

Also drops the running "already fixed and removed" list from BUGS.md: the file
tracks open findings, and `git log --all --grep 'B-nn'` is the record of how a
closed one was closed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app/auth/security.py

@@ -5,6 +5,7 @@ import logging
 import jwt
 from argon2 import PasswordHasher
 from argon2.exceptions import InvalidHashError, VerificationError
+from starlette.concurrency import run_in_threadpool
 
 from app.config import settings
 
@@ -39,6 +40,28 @@ def verify_password(password: str, password_hash: str) -> bool:
         return False
 
 
+# --- B-55: the two Argon2 calls above must never run on the event loop ----------
+# Argon2 is deliberately expensive — tens of milliseconds of CPU per call, by
+# design. Called straight from an async handler that stalls the *whole* process
+# for that long: every other request, and all six background tasks (scheduler,
+# confirmation poller, RBF bumper, listener, both reconcilers). A burst of
+# unauthenticated login attempts was therefore a cheap way to delay draws and
+# confirmations, not just to slow down logins. The threadpool keeps the cost
+# where it belongs — on a worker thread, with the loop free to run everything
+# else meanwhile.
+#
+# The synchronous functions stay: they're what the wrappers call, and what tests
+# and scripts (no running loop) use directly. Every async caller must use these.
+
+
+async def hash_password_async(password: str) -> str:
+    return await run_in_threadpool(hash_password, password)
+
+
+async def verify_password_async(password: str, password_hash: str) -> bool:
+    return await run_in_threadpool(verify_password, password, password_hash)
+
+
 def create_access_token(user_id: int, token_version: int = 0) -> str:
     expires_at = datetime.now(timezone.utc) + timedelta(minutes=settings.jwt_expire_minutes)
     # "tv" lets get_current_user (app/auth/dependencies.py) reject a token issued