Replace unsalted SHA-256 password hashes with argon2id (rehash on login)

[can3p]

Passwords are stored as sha256(email + ":" + password) (pkg/pgsession/hash.go). That hash has no per-user salt and no work factor, so a leaked database could be brute-forced quickly. It also ties the hash to the email, which means a user can't change their email without resetting their password.

Proposal

• Store new hashes as argon2id (or bcrypt) in PHC string format, $argon2id$v=19$..., so the algorithm is self-describing.
• At login, try the new format first, then fall back to the legacy SHA-256. When a legacy hash matches, rehash with argon2id in the same request.
• Once no legacy hashes remain, drop the fallback.
• Do this together with Email addresses are case-sensitive at login and invite, but lowercased at signup #114 (email case), which needs the email lowercased before hashing anyway.

Reproduction of the current behavior: sign up, then SELECT pwdhash FROM users. It is a 64-character hex SHA-256 digest. The same email and password always produce the same hash, and no per-user salt is stored.