passlib 1.7.4 has a known bug with bcrypt 4.x on Python 3.13 where detect_wrap_bug passes an over-72-byte hash as a password, causing ValueError on every login attempt. Switched to bcrypt.hashpw/checkpw directly, removing the passlib dependency entirely. Also fixed 401 page reload on /auth/login endpoint. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>