Hash passwords with 1 MiB in tests so make test fits in 4 GiB (closes #261)

On a build machine with 4 GiB, `docker build .` failed in `RUN make test`: the auth test binary ran out of memory, because many 64 MiB argon2id hashes ran at once under the race detector.

The memory per hash is now the auth service's `ArgonMemory` field. `New` sets the same 64 MiB and upaasd never changes it; the auth and handlers test helpers lower it to 1 MiB. One test still hashes and verifies a password at 64 MiB. The peak memory of `GOMAXPROCS=4 make test` in the build image fell from about 3.1 GiB to 1.0 GiB.

Not run on a 4 GiB arm64 machine.

Model: opus-5-5

internal/service/auth/auth_test.go

@@ -65,6 +65,10 @@ func setupTestService(t *testing.T) (*auth.Service, func()) {
 	})
 	require.NoError(t, err)
 
+	// 1 MiB per hash instead of 64 MiB; see Service.ArgonMemory. The tests
+	// that use setupAuthService keep 64 MiB.
+	svc.ArgonMemory = 1024
+
 	// t.TempDir() automatically cleans up after test
 	cleanup := func() {}
 
@@ -237,6 +241,21 @@ func TestVerifyPassword(testingT *testing.T) {
 	})
 }
 
+// TestHashPasswordWithUpaasdMemory hashes and verifies a password with the
+// memory New sets, which upaasd uses. setupTestService lowers it.
+func TestHashPasswordWithUpaasdMemory(t *testing.T) {
+	t.Parallel()
+
+	svc := setupAuthService(t, false)
+	require.Equal(t, uint32(64*1024), svc.ArgonMemory)
+
+	hash, err := svc.HashPassword("correctpassword")
+	require.NoError(t, err)
+
+	assert.True(t, svc.VerifyPassword(hash, "correctpassword"))
+	assert.False(t, svc.VerifyPassword(hash, "wrongpassword"))
+}
+
 func TestIsSetupRequired(testingT *testing.T) {
 	testingT.Parallel()