Replace SHA256 password hashing with Argon2id for dashboard auth

[RamXX]

Summary

Dashboard password hashing used plain SHA256 without a salt. SHA256 is a general-purpose hash, not a password hash: it is fast to compute and vulnerable to rainbow tables and GPU-accelerated brute force. This replaces it with Argon2id, the OWASP-recommended password hashing algorithm, using the PHC string format with random per-hash salts.

This is a breaking change for users who have dashboard auth enabled ([auth] enabled = true). Existing SHA256 hashes in config.toml will no longer be accepted. To upgrade, run openfang auth hash-password, paste the new hash into config.toml, and restart the daemon. Dashboard auth is opt-in (disabled by default), so most users are unaffected.

No new dependencies are introduced. Both argon2 and rand were already in the workspace (used by openfang-extensions for credential vault key derivation); this PR adds them to openfang-api's Cargo.toml.

Changes

• hash_password() now produces Argon2id PHC strings with random salts
• verify_password() only accepts Argon2id hashes (rejects legacy SHA256)
• Updated AuthConfig::password_hash doc comment to reflect the new format
• Added tests: Argon2id output format, unique salts, SHA256 rejection, malformed hash rejection, garbage input rejection
• Added [auth] section to docs/configuration.md (was previously undocumented)
• Updated docs/troubleshooting.md FAQ to reference built-in dashboard auth instead of reverse proxy workaround
• Added breaking change entry to CHANGELOG.md

Testing

• cargo clippy --workspace --all-targets -- -D warnings passes
• cargo test --workspace passes
• Live integration tested (if applicable)

Security

• No new unsafe code
• No secrets or API keys in diff
• User input validated at boundaries

[jaberjaber23]

The crypto is solid — correct Argon2id with random salts, OWASP-compliant defaults, PHC format, constant-time verification. The argon2 crate is already trusted in our vault.

However there is a blocking issue: the PR references openfang auth hash-password in the CHANGELOG, docs/configuration.md, and docs/troubleshooting.md. This command does not exist in the CLI. Without it, users have no way to generate Argon2id hashes after upgrading and will be silently locked out of the dashboard.

Please either add the CLI subcommand or update the docs to reference an alternative method.

Also recommend adding a startup warning when auth.enabled = true and password_hash doesn't start with $argon2 so users know why login fails after upgrade.