pub async fn hash_password_async(password: String) -> AppResult<String>
Runs Argon2 on the blocking thread pool (it is deliberately CPU heavy).