Username enumeration via short-circuited password verification

Observable timing discrepancy in File Browser before 2.55.0 allows remote attackers to enumerate valid usernames via /api/login. JSONAuth.Auth returns immediately for an unknown username but runs users.CheckPwd with bcrypt when the username exists, exposing account validity through response time. No authentication or user interaction is required; the disclosed consequence is valid-account discovery that supports targeted password attacks.