/**
 * Single source of truth for the bcrypt work factor (cost) used when
 * hashing secrets at rest — login passwords and 2FA backup codes.
 *
 * Bumped 10 → 12 (2026 baseline) per the May 2026 security review. 12
 * rounds is the OWASP-recommended floor for bcrypt on modern hardware and
 * roughly 4× the work of cost 10, keeping offline cracking expensive
 * without a noticeable hit to interactive login latency.
 *
 * Existing hashes stay valid: bcrypt encodes its own cost in the hash
 * string, so `bcrypt.compare` verifies old (cost-10) and new (cost-12)
 * hashes alike. Only newly-created hashes use this constant.
 */
export const BCRYPT_COST = 12;