Unauthenticated account enumeration via login timing discrepancy

Observable timing discrepancy in TREK before 3.0.18 allows remote attackers to enumerate registered email addresses through login requests. POST /api/auth/login returns immediately for an unknown email but performs a slow bcrypt comparison for an existing account before returning the same 401 response. No authentication or user interaction is required, and the resulting account list supports targeted password and phishing attacks.