ci: shard test job + cheap argon2 in test mode

Test job was wall-clocked by `internal/server/http` (~156s on the
self-hosted runner under -race). Two changes here cut that:

1. Matrix-shard the test job by package group: server-http, store,
   and "rest" (everything else, computed via `go list | grep -v`).
   Each shard runs on its own runner so the heavy package isn't
   CPU-starved by siblings.

2. `auth.HashPassword` drops to cheap argon2id params (8 KiB / 1
   iter / 1 lane) when `testing.Testing()` returns true. Production
   params are unchanged. VerifyPassword reads params from the
   encoded hash so cheap-params hashes verify identically — no test
   call sites need to change.

.gitea/workflows/ci.yml

@@ -53,8 +53,24 @@ env:
 
 jobs:
   test:
-    name: Test (linux/amd64)
+    # Sharded by package group. server/http and store are the two
+    # heavy packages (~156s and ~75s in CI respectively under
+    # `-race`); pulling them onto their own runners lets each shard
+    # have all CPUs to itself instead of CPU-starving each other on
+    # one runner. The third shard ("rest") covers everything else.
+    name: Test (${{ matrix.name }})
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: server-http
+            packages: ./internal/server/http/...
+          - name: store
+            packages: ./internal/store/...
+          - name: rest
+            # Computed at runtime — see the "go test" step below.
+            packages: ""
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
@@ -64,7 +80,18 @@ jobs:
       - name: go vet
         run: go vet ./...
       - name: go test
-        run: go test -race -coverprofile=coverage.out ./...
+        run: |
+          set -euo pipefail
+          if [ -n "${{ matrix.packages }}" ]; then
+            pkgs="${{ matrix.packages }}"
+          else
+            # "rest" shard: everything except the dedicated shards.
+            pkgs=$(go list ./... \
+              | grep -v '/internal/server/http$' \
+              | grep -v '/internal/store$')
+          fi
+          # shellcheck disable=SC2086
+          go test -race -coverprofile=coverage.out $pkgs
       - name: coverage summary
         run: go tool cover -func=coverage.out | tail -1