fix: pin bcrypt for Velocity-OS auth

core/requirements.txt

@@ -11,6 +11,7 @@ supabase>=2.10.0
 asyncpg>=0.31.0          # Raw PostgreSQL async driver (no ORM)
 python-jose[cryptography]>=3.3.0  # JWT encode/decode
 passlib[bcrypt]>=1.7.4   # bcrypt password hashing
+bcrypt>=4.0,<5           # passlib 1.7.x is not compatible with bcrypt 5.x long-input enforcement
 httpx>=0.28.0            # Async HTTP client for NemoClaw API calls
 pynvml>=11.5.0           # GPU VRAM health checks before NemoClaw inference
 python-multipart>=0.0.9 # Multipart form parsing for CSV uploads