perf: isolate authentication database work (#311)

src/main.py

@@ -586,7 +586,7 @@ async def sign_in(payload: DashboardSignIn, request: Request, response: Response
     )
     attempts = _login_attempt_store()
     try:
-        retry_after = attempts.retry_after(source)
+        retry_after = await asyncio.to_thread(attempts.retry_after, source)
     except LoginAttemptStoreError:
         return JSONResponse(
             {"detail": "Sign-in throttling is temporarily unavailable"},
@@ -607,7 +607,7 @@ async def sign_in(payload: DashboardSignIn, request: Request, response: Response
         payload.access_token, configured_token
     ):
         try:
-            attempts.record_failure(source)
+            await asyncio.to_thread(attempts.record_failure, source)
         except LoginAttemptStoreError:
             return JSONResponse(
                 {"detail": "Sign-in throttling is temporarily unavailable"},
@@ -616,7 +616,7 @@ async def sign_in(payload: DashboardSignIn, request: Request, response: Response
             )
         raise HTTPException(status_code=401, detail="Invalid access token")
     try:
-        attempts.clear(source)
+        await asyncio.to_thread(attempts.clear, source)
     except LoginAttemptStoreError:
         return JSONResponse(
             {"detail": "Sign-in throttling is temporarily unavailable"},
@@ -624,7 +624,7 @@ async def sign_in(payload: DashboardSignIn, request: Request, response: Response
             headers={"Cache-Control": "no-store"},
         )
     try:
-        signed, session = dashboard_auth.issue_session()
+        signed, session = await asyncio.to_thread(dashboard_auth.issue_session)
     except dashboard_auth.SessionStoreError:
         return JSONResponse(
             {"detail": "Session registry is temporarily unavailable"},
@@ -668,7 +668,7 @@ async def session_status(request: Request):
 async def sign_out(request: Request, response: Response):
     session = request.state.dashboard_session
     try:
-        dashboard_auth.revoke_session(session)
+        await asyncio.to_thread(dashboard_auth.revoke_session, session)
     except dashboard_auth.SessionStoreError:
         return JSONResponse(
             {"detail": "Session registry is temporarily unavailable"},