Speed up the test suite: cheap Argon2 in tests, add xdist

[ALeonard9]

Story

As Adam-as-operator, I want the test suite to run in a fraction of the time, so that the pre-push hook and CI stop being a reason to avoid running tests.

Acceptance Criteria

• Argon2 runs with reduced cost parameters in tests only — production hashing configuration is untouched and there is a test asserting the production path still uses the strong settings
• pytest-xdist is added and the suite passes under -n auto with no cross-worker interference
• The chosen worker count is wired into the default invocation (pytest config or the taskfile), not left as something to remember to type
• The pre-push pytest --testmon hook still works alongside the parallel run
• Suite wall-clock time is recorded before and after in the PR description

Context

Found while profiling after Phases 0–1 merged (#283). Separate from #284, which is a reliability problem; this one is purely speed. #284 should land first — it removes ~350s of the 405s, and the numbers here only make sense measured against what remains.

Argon2 cost. app/db/hash.py uses Argon2Hasher() at library defaults. Measured on the dev machine:

	hash	verify	cycle
defaults	35.6 ms	36.2 ms	72 ms
time_cost=1, memory_cost=8, parallelism=1	0.07 ms	0.04 ms	0.11 ms

test_load_database in tests/conftest.py runs for every test using test_client and performs six of those operations — creating admin, first_user and second_user, then authenticating all three. That is ~216 ms per test before a single assertion, or roughly 68 seconds across 315 integration tests.

Argon2 being slow is the entire point in production. No test asserts anything about hash strength, so in tests it buys nothing. The safeguard is the second half of the first criterion: reducing cost must be provably test-only, or this trades a slow suite for a weak production default.

No parallelism. pytest-xdist is not installed, so 750 tests run on one core. The fixtures are already worker-safe: a session-scoped in-memory SQLite engine with StaticPool and per-test transaction rollback means each worker gets its own isolated database.

Estimate

• Recommended model: Sonnet 5 — contained configuration work, though the test-only override needs care to avoid weakening production.
• Human effort: S — one review pass on the production-safety assertion.

Notes for Implementation

Override the hasher through the existing settings/config mechanism rather than monkeypatching app.db.hash.pwd_cxt from conftest. A patch that only applies when conftest is imported is one refactor away from silently not applying, and the failure mode is a slow suite — which nobody investigates.