[tee8z]

Follows #9. Applies the replay verifier's admission pattern from #9 to the password routes.

What changed and why

Bounded password work. /api/v1/users/username/register, /api/v1/users/username/login and /api/v1/users/reset-password called Argon2 (19 MiB, tens of milliseconds per job) directly on runtime worker threads with no bound. Login needs no authentication, so a flood using public leaderboard names could occupy every runtime worker and stall every route.

• PasswordWork::admit() -> PasswordPermit in domain/users/password.rs mirrors ReplayVerifier::admit() -> ReplayPermit: one shared budget of two workers for all password hashing and verification, no waiting queue.
• The permit moves into the spawn_blocking job, so a disconnected caller cannot release capacity while Argon2 still runs.
• Each handler admits just before its Argon2 pass, after its database lookups, so a slow lookup cannot hold a worker. Login looks the name up on both paths before admission, so a refusal reveals nothing about the name. When both slots are busy it answers 503 with Retry-After: 1, rendered the same way as the replay busy response. The existing client already shows the response text.
• hash_password and verify_password are now private, so password work can only run through a permit.
• AppState carries the budget beside replay_verifier.

Real verification for unknown users. The login dummy hash used a seven-byte salt. argon2 0.5 refuses salts under eight bytes before hashing, so unknown usernames answered much faster than real accounts, which allowed username enumeration. Unknown users now verify against a hash built once from a random password, on first use and inside the blocking job.

Verification errors are no longer a mismatch. verify_password returned Ok(false) for any error. It now returns Ok(false) only for a wrong password. A malformed stored hash is logged as an internal error and still answered as the generic 401 login failure.

The README's authentication section documents the 503 behaviour.

Tests (in domain/users/password.rs)

• unknown_user_verification_runs_a_real_argon2_pass: verifying a password against the dummy hash returns Ok(false), not an error. The old seven-byte-salt hash fails this test.
• malformed_stored_hash_is_an_error_not_a_mismatch: the old short-salt hash and a non-PHC string return VerifyError instead of Ok(false).
• stored_hash_accepts_only_its_password_and_unknown_users_never_pass: a hash made through a permit accepts its password and rejects another. Verifying with no stored hash returns false.
• saturated_work_refuses_until_jobs_end_even_after_cancellation: with both slots held, a third admission returns Busy, which renders as 503 with retry-after: 1. Aborting a caller mid-job does not free its slot. The slot comes back once that job ends, observed by awaiting the semaphore, not by sleeping. A caller that waits for its result has its slot back by then. The test uses channels and no sleeps.
• failed_worker_returns_its_slot: a panicking job maps to WorkerFailed and its slot comes back.

Skipped from the review

• Router-level 503 test for login: the crate has no router or AppState test fixture to copy. Building one would mean constructing the Lightning, ledger and store services for a single assertion. The 503 rendering is asserted on PasswordError::Busy. Each route's wiring is a single admit() call right before its Argon2 pass.