Account enumeration via login response timing

Observable timing discrepancy in Open WebUI before 0.10.0 allows remote attackers to enumerate registered accounts through sign-in requests. The /api/v1/auths/signin path returns before bcrypt work when no email record exists, while valid accounts trigger the expensive comparison. No authentication or user interaction is required; the timing signal discloses only whether an account exists and enables targeted password spraying.