Scenario 10: Login requests are taking 2+ seconds each under moderate load, and profiling points to BCryptPasswordEncoder.matches(). What's happening, and how do you fix it?

BCrypt's 'strength' (work factor) controls how computationally expensive each hash operation is by design — a strength set too high (e.g., 15-16) for the available hardware can make each login take seconds instead of milliseconds. Benchmark and tune the strength value (commonly 10-12) to balance security against acceptable login latency for your actual server hardware, rather than assuming a higher number is always better.