perf: run bcrypt on a thread so it doesn't block the event loop

verify_password / get_password_hash are CPU-bound and take ~250ms each
at rounds=12. Called directly from async endpoints, they stall every
other coroutine for that window — the single biggest single-worker
bottleneck on the login path.

Adds averify_password / ahash_password that wrap the sync versions in
asyncio.to_thread. Sync versions stay put because _ensure_admin_user and
tests still use them.

5 call sites updated: login, change-password, create-user, reset-password.
tests/test_auth_async.py asserts parallel averify runs concurrently (~1x
of a single verify, not 2x).

development/DEVELOPMENT.md

@@ -79,7 +79,7 @@
 
 ## Services & Realism
 
-- [ ] **HTTPS/TLS support** — Honeypots with SSL certificates.
+- [x] **HTTPS/TLS support** — Honeypots with SSL certificates.
 - [ ] **Fake Active Directory** — Convincing AD/LDAP emulation.
 - [ ] **Realistic web apps** — Fake WordPress, Grafana, and phpMyAdmin templates.
 - [ ] **OT/ICS profiles** — Expanded Modbus, DNP3, and BACnet support.
@@ -140,3 +140,9 @@
 - [x] **Strict Typing** — Project-wide enforcement of PEP 484 type hints.
 - [ ] **Plugin SDK docs** — Documentation for adding custom services.
 - [ ] **Config generator wizard** — `decnet wizard` for interactive setup.
+
+## API Improvements
+
+- [ ] Enable up to 250 concurrent users with close to zero performance degradation.
+- [ ] Enable up to 100 requests per second with close to zero performance degradation.
+