CI: cut go test -race time by lowering bcrypt cost in tests

CLAUDE.md

@@ -93,7 +93,7 @@ Entry point: `main.go` → opens SQLite DB → runs CLI or starts HTTP server on
 - `phoenix/` — HTTP client for Phoenix Server API (invoices, payments, balance, channels). Uses basic auth from phoenix config (password cached at startup with `sync.Once`)
 - `crypto/` — AES-CMAC authentication and AES decryption for Bolt Card NFC protocol
 - `util/` — Error handling helpers (`CheckAndLog`), random hex generation, QR code encoding
-- `build/` — Version string (currently "0.22.2"), date/time injected at build
+- `build/` — Version string (currently "0.22.3"), date/time injected at build
 - `web-content/` — Static assets under `public/`, SPA build output under `admin/spa/`
 
 ### Route Groups (`web/app.go`)

docker/card/build/build.go

@@ -1,5 +1,5 @@
 package build
 
-var Version string = "0.22.2"
+var Version string = "0.22.3"
 var Date string
 var Time string

docker/card/web/main_test.go

@@ -0,0 +1,19 @@
+package web
+
+import (
+	"os"
+	"testing"
+
+	"golang.org/x/crypto/bcrypt"
+)
+
+// TestMain lowers the bcrypt work factor for the whole web test package.
+// Production keeps bcrypt.DefaultCost (see HashPassword in util.go); the
+// admin-login and 2FA recovery-code tests hash dozens of values per run, and
+// at DefaultCost that hashing — amplified by the race detector — dominated
+// CI's `go test -race` step (~3 min). MinCost keeps the hashing path fully
+// exercised while making it roughly 64x cheaper.
+func TestMain(m *testing.M) {
+	bcryptCost = bcrypt.MinCost
+	os.Exit(m.Run())
+}

docker/card/web/util.go

@@ -25,8 +25,14 @@ func GetPwHash(db_conn *sql.DB, passwordStr string) (passwordHashStr string) {
 	return passwordHashStr
 }
 
+// bcryptCost is the work factor used for all password/recovery-code hashing.
+// Production keeps bcrypt.DefaultCost; the test suite lowers it (see TestMain
+// in main_test.go) because the admin-login and 2FA tests hash dozens of values
+// and at DefaultCost that alone dominated CI's `go test -race` step.
+var bcryptCost = bcrypt.DefaultCost
+
 func HashPassword(passwordStr string) (string, error) {
-	hash, err := bcrypt.GenerateFromPassword([]byte(passwordStr), bcrypt.DefaultCost)
+	hash, err := bcrypt.GenerateFromPassword([]byte(passwordStr), bcryptCost)
 	return string(hash), err
 }