Auth: password hashing (argon2/bcrypt) + login throttling

Scope: hash passwords with argon2id (or bcrypt) — never store plaintext. Add per-IP/email login rate limiting + lockout after N failures.

Done when: stored hashes are salted+slow, timing-safe compare, brute force is throttled.