Tests pass under heavy host load (closes #233)

The suite timed out when this host was heavily loaded. vitest now runs at most four workers instead of one per CPU core. `test/cli/bin.test.ts` loads the sources `bin/quak.ts` imports and starts libsodium once, before its tests, so no test pays for the first load. The fake accounts in `test/ente-server.ts` and `test/thumbnails/thumbnails.test.ts` stretch their passwords at libsodium's lowest Argon2id cost, since every login stretches them again.

Judgement call: the login, usage, unwrap and KDF tests keep the realistic 64 MiB cost.

Model: opus-5-5

test/cli/bin.test.ts

@@ -7,6 +7,11 @@
  * Each test runs `bin/quak.ts`, as the smoke test does, with its session loader
  * replaced by one that records the options it is given and reports no session,
  * so the command stops before it makes any request.
+ *
+ * The first load of the sources `bin/quak.ts` imports compiles them, and the
+ * first `init()` starts libsodium. On a loaded host that takes longer than a
+ * test's timeout, so both happen here, before the tests run. Each test's
+ * `vi.resetModules()` then only runs the compiled sources again.
  */
 
 import { mkdtempSync, rmSync } from "node:fs";
@@ -14,8 +19,13 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterAll, afterEach, describe, expect, it, vi } from "vitest";
 import type { ApiClientOptions } from "../../src/api/client.js";
+import "../../src/cli-commands.js";
+import { init } from "../../src/crypto/index.js";
+import "../../src/index.js";
 import { UNATTENDED_RETRY_OPTIONS } from "../../src/retry.js";
 
+await init();
+
 const loaded = vi.hoisted(() => [] as (ApiClientOptions | undefined)[]);
 
 vi.mock("../../src/cli-session.js", () => ({

test/ente-server.ts

@@ -19,8 +19,11 @@ import { SRP, SrpServer } from "fast-srp-hap";
 import { toBase64, deriveKEK, deriveLoginSubkey } from "../src/crypto/index.js";
 import type { KeyAttributes } from "../src/auth/types.js";
 
-const TEST_OPS = 2;
-const TEST_MEM = 64 * 1024 * 1024;
+// The account's password is stretched at libsodium's lowest Argon2id cost.
+// Every login stretches it again, and at a realistic cost that takes seconds on
+// a loaded host.
+const TEST_OPS = 1;
+const TEST_MEM = 8192;
 
 export interface MetaMockState {
     verifier: Buffer;

test/thumbnails/thumbnails.test.ts

@@ -57,8 +57,11 @@ import type { RetryOptions } from "../../src/retry.js";
 
 const TEST_EMAIL = "thumb@example.com";
 const TEST_PASSWORD = "thumbpass";
-const TEST_OPS = 2;
-const TEST_MEM = 64 * 1024 * 1024;
+// The password is stretched at libsodium's lowest Argon2id cost. Each test
+// builds an account and logs in, and at a realistic cost that takes seconds on
+// a loaded host.
+const TEST_OPS = 1;
+const TEST_MEM = 8192;
 const TEST_TIME = 1700000000000000;
 
 interface ThumbMockState {