Fix: use async bcrypt in findMatchingKey #3878

[Nixxx19]

Fixes #3878

Changes

Replaced bcrypt.compareSync() with bcrypt.compare() in the findMatchingKey method to prevent blocking the Node.js event loop during API key authentication.

Before:

• Used synchronous bcrypt.compareSync() which blocks the event loop
• await on a boolean return value had no effect

After:

• Uses asynchronous bcrypt.compare() which returns a Promise
• Properly awaits the async operation, keeping the server responsive under concurrent load

Why this is better:

• Non-blocking: bcrypt.compare() runs asynchronously, so API key verification no longer blocks the Node.js event loop during hash comparisons
• Correct async semantics: await now waits on a real Promise instead of a boolean, matching the intent of the async method signature
• Better performance under load: Under concurrent API key authentication requests, the server remains responsive since comparisons don't serialize the event loop

I have verified that this pull request:

• has no linting errors (npm run lint)
• has no test errors (npm run test)
• has no typecheck errors (npm run typecheck)
• is from a uniquely-named feature branch and is up to date with the develop branch.
• is descriptively named and links to an issue number, i.e. Fixes #3878
• meets the standards outlined in the accessibility guidelines