perf: replace bcryptjs with native bcrypt for password hashing

Co-authored-by: Cursor <[email protected]>

src/lib/auth/password.test.ts

@@ -1,4 +1,4 @@
-import { hash as bcryptHash } from "bcryptjs";
+import { hash as bcryptHash } from "bcrypt";
 import { describe, expect, it } from "vitest";
 import {
 	checkLogin,
@@ -50,9 +50,9 @@ describe("hashPassword (PASSWORD_HASH=argon2id)", () => {
 
 describe("bcrypt", () => {
 	it("verifies a bcrypt hash and accepts the PHP $2y$ prefix", async () => {
-		const h = await bcryptHash("hunter2", 10); // bcryptjs emits $2a$
+		const h = await bcryptHash("hunter2", 10); // native bcrypt emits $2a$/$2b$
 		expect(await verifyPassword("hunter2", h)).toBe(true);
-		// PHP stores $2y$ — bcryptjs must accept it as equivalent.
+		// PHP stores $2y$ — bcrypt must accept it as equivalent.
 		const phpStyle = h.replace(/^\$2[ab]\$/, "$2y$");
 		expect(await verifyPassword("hunter2", phpStyle)).toBe(true);
 		expect(await verifyPassword("nope", h)).toBe(false);