Account enumeration via differential login errors

Information disclosure in Lemmy before 0.19.19 and 1.0.0-beta.1 allows remote attackers to confirm valid accounts via login responses. In crates/api/api/src/local_user/login.rs, the login path lets LocalUserView::find_by_email_or_name propagate a NotFound condition for unknown accounts, while existing accounts with bad passwords return IncorrectLogin, creating a 404-versus-400 oracle; the fix normalizes lookup failures and adds dummy bcrypt verification for constant timing. No authentication or user interaction is required, but the exposed data is limited to whether a username or email is registered, which supports follow-on credential attacks or social engineering.