test(session): give the change-password case a timeout that fits its work

The bcrypt change-password case runs six bcryptjs rounds (one hash to create
the user, four verifies, one hash for the new password). bcryptjs is pure JS,
so it takes ~4.5s on an idle machine against vitest's 5s default — and tipped
over whenever the full suite saturated the CPU. It read as an intermittent
failure but the work is genuinely slow, not hung.

The new #149 tests spawn real ffmpeg processes, which added enough CPU
pressure to turn an occasional flake into a near-every-run failure, so fix it
rather than leave a suite that cries wolf.

Raise this one case to 20s. Suite is now stably green across repeated full
runs: 138 files / 2109 tests.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/web/api/session.test.ts

@@ -167,7 +167,13 @@ describe("session router", () => {
     expect(meB.status).toBe(401);
 
     expect(u.id).toBe(meA.body.id);
-  });
+    // 20s, not the 5s default: this case runs SIX bcryptjs rounds (one hash to
+    // create the user, four verifies, one hash for the new password), and
+    // bcryptjs is pure JS. It takes ~4.5s on an idle machine — close enough to
+    // the default that it tipped over whenever the full suite saturated the
+    // CPU, which made it look like a real intermittent failure. The work is
+    // genuinely slow, not hung, so the timeout is what was wrong.
+  }, 20000);
 });
 
 describe("session router — guest mode", () => {