feat: migrate passwords from SHA-256 to bcrypt

- Replace SHA-256 hex hashing with bcrypt (cost 10) for password storage
- VerifyPassword now uses bcrypt.CompareHashAndPassword
- HashPassword returns (string, error) instead of string
- Add IsBcryptHash helper to detect legacy hashes for future migration
- Remove duplicate verifyPassword from api.go (already done in prev commit)
- Promote golang.org/x/crypto to direct dependency

internal/api/api.go

@@ -179,7 +179,11 @@ func (h *Handler) register(w http.ResponseWriter, r *http.Request) {
 	}
 
 	uuid := auth.GenerateUUID()
-	passwordHash := auth.HashPassword(req.Password)
+	passwordHash, err := auth.HashPassword(req.Password)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, "Failed to hash password")
+		return
+	}
 
 	_, err = h.db.Pool().Exec(r.Context(),
 		`INSERT INTO users (username, email, password_hash, uuid, role)