perf(crypto): derive Argon2id via argon2idAsync (unfreeze unlock UI)

deriveKeyBytes now calls NobleArgon2.argon2idAsync instead of the sync
argon2id, so it yields to the event loop periodically and the busy/unlock
spinner keeps animating instead of freezing ~0.65 s during login, register,
and master-pw rotation. Same result (both RFC-9106-verified); all callers
already await deriveKeyBytes so no call-site changes.

- Re-vendored js/argon2.js to export argon2idAsync alongside argon2id
  (re-bundled from @noble/hashes@2.2.0; both variants pass the RFC 9106 §5.3
  vector). 27KB → 29KB.
- Added a sync/async parity test. 63/63 green.
- Closes the last open item of CODE_AUDIT §1.2.

NOTE: argon2.js grew — run BuildAssets to re-embed it before the next
Delphi build.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

js/app.crypto.js

@@ -96,10 +96,13 @@ async function verifierFromKeyHex(keyHex, algo) {
 async function deriveKeyBytes(pwd, saltHex, algo, iterations, argonParams) {
     const enc = new TextEncoder();
     if (algo === HASH_ALGO_ARGON2) {
-        if (typeof NobleArgon2 === 'undefined' || !NobleArgon2 || !NobleArgon2.argon2id)
+        if (typeof NobleArgon2 === 'undefined' || !NobleArgon2 || !NobleArgon2.argon2idAsync)
             throw new Error('Argon2 library not loaded (js/argon2.js missing?)');
         const p = argonParams || ARGON2_DEFAULT_PARAMS;
-        return NobleArgon2.argon2id(enc.encode(pwd), enc.encode(saltHex),
+        // Async variant yields to the event loop periodically so the unlock
+        // spinner keeps animating instead of freezing ~0.65 s. Same result as
+        // the sync argon2id (both RFC-9106-verified).
+        return await NobleArgon2.argon2idAsync(enc.encode(pwd), enc.encode(saltHex),
             { t: p.t, m: p.m, p: p.p, dkLen: 32, version: 0x13 });
     }
     // PBKDF2-SHA256 (default / legacy).