fix: replace passlib with direct bcrypt calls to fix bcrypt 5.x incompatibility

passlib 1.7.4 is incompatible with bcrypt>=5.0.0. When passlib initializes
its bcrypt backend, it calls detect_wrap_bug() with a >72-byte test password.
bcrypt 5.0.0 raises ValueError for such passwords, crashing the initialization
before any user code runs.

Fix: replace passlib[bcrypt] with direct bcrypt==4.3.0 usage:
- security.py: use bcrypt.hashpw()/checkpw() instead of CryptContext
- requirements.txt: replace passlib[bcrypt]==1.7.4 with bcrypt==4.3.0

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Agent-Logs-Url: https://github.com/christianlouis/pop_puller_to_gmail/sessions/a2327bbe-cc06-4c1f-9010-380fb0fd7d67

backend/requirements.txt

@@ -12,7 +12,7 @@ asyncpg==0.29.0
 
 # Authentication
 python-jose[cryptography]==3.3.0
-passlib[bcrypt]==1.7.4
+bcrypt==4.3.0
 python-multipart==0.0.22  # Updated: Fixed multiple vulnerabilities (was 0.0.6)
 authlib==1.6.9  # Updated: Fixed OIDC hash binding, JWE RSA1_5 padding oracle, alg:none bypass, JWK header injection (was 1.6.6)
 httpx==0.26.0