createSession ran Argon2id inline on the async runtime, and the per-address rate limiter alone did not cap how many hashes could run at once; on the 2 GiB t3.small this deploys onto, enough concurrent callers could exhaust memory well before hitting any per-caller limit. Move the hash onto spawn_blocking behind an 8-permit semaphore, which caps hashing memory at roughly 152 MiB regardless of client concurrency. Change-Id: I689c3954c2305a71134d7ad6a8d02688d3a60fa7