refactor: switch password hashing from argon2 to bcrypt

- hashPassword now emits bcrypt (cost 12) instead of argon2id
- checkLogin migrates legacy md5/argon2id hashes to bcrypt on sign-in
- keep argon2id verification only as a one-time migration path
- replace ARGON2_* env vars with BCRYPT_COST

src/env.ts

@@ -51,15 +51,13 @@ const schema = z
 		APP_KEY: z.string().optional(),
 
 		// Mirrors Laravel config('habbo.site.convert_passwords') — enables
-		// legacy md5/bcrypt hashes to be upgraded to argon2id on login.
+		// legacy md5/argon2id hashes to be upgraded to bcrypt on login.
 		CONVERT_PASSWORDS: z
 			.string()
 			.optional()
 			.transform((v) => v === "true" || v === "1"),
-		// Argon2id parameters — defaults match the old AtomCMS (Laravel) setup.
-		ARGON2_MEMORY_KB: z.coerce.number().int().positive().default(65_536),
-		ARGON2_ITERATIONS: z.coerce.number().int().positive().default(4),
-		ARGON2_PARALLELISM: z.coerce.number().int().positive().default(1),
+		// bcrypt cost factor used for new password hashes.
+		BCRYPT_COST: z.coerce.number().int().min(4).max(31).default(12),
 		// Filesystem dir the badge uploader writes <code>.gif into (the emulator's
 		// badge image folder, e.g. .../assets/c_images/album1584). Upload is disabled
 		// when unset.