⚡ Bolt: offload bcrypt operations to threadpool

[benpiper]

💡 What: Offloads CPU-bound bcrypt operations (bcrypt.hashpw and bcrypt.checkpw) to a background threadpool using starlette.concurrency.run_in_threadpool and changes their containing functions to be asynchronous (async def).
🎯 Why: bcrypt hashing and checking are intensely CPU-bound and synchronous. Since FastAPI (and specifically uvicorn/Starlette) relies on an async event loop to serve concurrent requests, blocking this event loop with synchronous cryptography significantly degrades performance and blocks all other incoming API requests while the password is being hashed/checked.
📊 Impact: Expected to massively improve concurrency under load by keeping the async event loop free. Passwords are still securely verified but background threads are utilized for computation.
🔬 Measurement: Test the login, register, or setup_initial_admin endpoints. They should successfully create and verify passwords identically to before. For load testing, concurrent requests to /api/auth/login and /api/features will demonstrate that login requests no longer block lightweight feature requests.

---

PR created automatically by Jules for task 9339006659968085135 started by @benpiper

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.