REST auth endpoints untested under real Postgres load

## Summary
`load-tests/rest-load-test.ts` benchmarks `/api/leaderboard` by default
(DB-free-safe), and supports `INCLUDE_AUTH=1` to also hit `/api/signup`
under load — but this hasn't been run against a real `DATABASE_URL` yet
(sandboxed dev environment had no Postgres/Prisma-engine access).

## What's needed
Run `INCLUDE_AUTH=1 npm run loadtest:rest` against a staging/deployed
instance with a real database to get actual numbers for:
- bcrypt cost-10 hashing throughput under concurrency
- Prisma connection pool behavior under concurrent signups/logins (now a
single shared pool post-#2, should be re-verified under load)

## Acceptance criteria
Numbers documented in `SCALABILITY_REPORT.md` alongside the existing
WebSocket findings.

Start with load-tests/rest-load-test.ts and run INCLUDE_AUTH=1 npm run loadtest:rest against a staging or deployed instance with a real DATABASE_URL. Capture bcrypt cost-10 throughput and Prisma connection-pool behavior under concurrent signups and logins, then document the numbers in SCALABILITY_REPORT.md alongside the existing WebSocket findings.

Written by the indexing model from the issue text.