Hash passwords with bcrypt instead of a single SHA-512 round

New passwords are stored as {BLF-CRYPT} with cost 12, which Dovecot 2.4
verifies. Existing {SSHA512} hashes are still checked and replaced at the
next login. Unknown users are checked against a dummy hash, so the
response time does not reveal whether an email exists.

bcrypt only uses 72 bytes and bcrypt 5 raises for longer passwords, so
validate_password limits passwords to 72 bytes when creating a user,
changing a password and in the CLI.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

requirements.in

@@ -1,5 +1,6 @@
 # Direct dependencies of MAX. Pinned versions with hashes are in requirements.txt,
 # generated by `make lock-deps` (see README).
+bcrypt>=5,<6
 Flask>=3.1,<4
 gunicorn>=26,<27
 psycopg2>=2.9,<3