Function enforce_auth_floor

nodedb/src/control/server/session_auth/native.rs:271–277

Sleep until `auth_start + AUTH_FLOOR` to enforce a constant-time error path. Called on every password-auth failure so that no failure mode (rate-limit, lockout, wrong password, unknown user) can be distinguished from any other by wall-clock timing. When Argon2 already ran, `auth_start` is old enough that the sleep duration is effectively zero.

(auth_start: std::time::Instant)

/// by wall-clock timing.  When Argon2 already ran, `auth_start` is old enough
/// that the sleep duration is effectively zero.
async fn enforce_auth_floor(auth_start: std::time::Instant) {
    let deadline = auth_start + AUTH_FLOOR;
    let now = std::time::Instant::now();
    if deadline > now {
        tokio::time::sleep(deadline - now).await;
    }
}