fix(auth): harden async login boundaries

backend/src/auth/local-registry.ts

@@ -246,10 +246,10 @@ export function createLocalUserRegistry(usersPath: string): LocalUserRegistry {
     },
     async verify(user: LocalUserRecord | undefined, password: string): Promise<boolean> {
       if (!user || !user.enabled) {
-        verifyWithDummy(password);
+        await verifyWithDummy(password);
         return false;
       }
-      return verifyPassword(password, user.passwordHash);
+      return await verifyPassword(password, user.passwordHash);
     },
   };
 }