Password sign-in done properly

PBKDF2 with a per-user salt, a constant-time check that costs the same for an unknown account, rate limits on both the address and the caller, and sessions stored as hashes.

Uses a workspace database. Forking copies the blocks, never the author's rows — your copy starts with an empty database, and the blocks create what they need on their first call. Included from the Pro plan up.