Keep make test under 2 GB of memory (closes #344)

Every test that starts a database hashed the bootstrap admin password
with Argon2id at 64 MB, which under -race holds about 150 MB per hash,
across dozens of parallel tests. The test packages that hash now lower
the memory cost to 1 MB from TestMain. One test still hashes and
verifies at the shipped parameters, which are unchanged.

script/test also runs at most four packages and eight parallel tests
at once: unbounded, a many-core host linked and ran every test binary
together.

Model: opus-5-5

internal/database/password.go

@@ -63,10 +63,24 @@ func DefaultPasswordConfig() *PasswordConfig {
 	}
 }
 
+// hashConfig is what HashPassword hashes with: the defaults above.
+// Only a test binary changes it, through LowerPasswordHashCostForTest,
+// before any test runs.
+//
+//nolint:gochecknoglobals // see above
+var hashConfig = DefaultPasswordConfig()
+
 // HashPassword generates an Argon2id hash of the password
 func HashPassword(password string) (string, error) {
-	config := DefaultPasswordConfig()
+	return hashPasswordWith(password, hashConfig)
+}
 
+// hashPasswordWith generates an Argon2id hash of the password with
+// the given parameters.
+func hashPasswordWith(
+	password string,
+	config *PasswordConfig,
+) (string, error) {
 	// Generate a salt
 	salt := make([]byte, config.SaltLen)