🐛 fix(auth): bound password derivations

[gaborbernat]

Argon2 work now uses one process-wide admission budget for running and queued derivations. Requests beyond the fixed four-active/four-waiting bound fail before identity lookup or hashing, while a canceled queued request releases its slot and a canceled running request remains charged until blocking work exits.

Every password-derived operation shares the same path, including decoys and stale-verifier upgrades. Public HTTP and distributed callers return service unavailable without exposing whether an account exists.

Closes #1466

[codspeed]

Merging this PR will not alter performance

✅ 23 untouched benchmarks
⏩ 139 skipped benchmarks¹

---

_{Comparing fix/password-queue-1466 (8f06f6c) with main (60698d6)}

Footnotes

1. 139 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[read-the-docs-community]

Documentation build overview

📚 peryx | 🛠️ Build #34294861 | 📁 Comparing 8f06f6c against latest (60698d6)

  🔍 Preview build  

1 file changed

± core/access/authentication/index.html