hoàn thành chức năng giai đoạn 1

backend/app/security.py

@@ -1,8 +1,8 @@
 from datetime import datetime, timedelta, timezone
 import os
 
+import bcrypt
 from jose import JWTError, jwt
-from passlib.context import CryptContext
 
 # ── Config (override via environment variables) ───────────────────────────────
 SECRET_KEY: str = os.environ["JWT_SECRET_KEY"]          # must be set — no default
@@ -11,16 +11,14 @@ ACCESS_TOKEN_EXPIRE_MINUTES: int = int(
     os.getenv("ACCESS_TOKEN_EXPIRE_MINUTES", "60")
 )
 
-# ── Password hashing ──────────────────────────────────────────────────────────
-_pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
-
+# ── Password hashing (use bcrypt directly — passlib has compat issues) ────────
 
 def hash_password(plain: str) -> str:
-    return _pwd_context.hash(plain)
+    return bcrypt.hashpw(plain.encode(), bcrypt.gensalt()).decode()
 
 
 def verify_password(plain: str, hashed: str) -> bool:
-    return _pwd_context.verify(plain, hashed)
+    return bcrypt.checkpw(plain.encode(), hashed.encode())
 
 
 # ── JWT ───────────────────────────────────────────────────────────────────────

backend/requirements.txt

@@ -2,7 +2,7 @@ fastapi==0.115.6
 uvicorn[standard]==0.30.6
 sqlalchemy==2.0.36
 psycopg2-binary==2.9.10
-passlib[bcrypt]==1.7.4
+bcrypt==4.0.1
 python-jose[cryptography]==3.3.0
 pydantic[email]==2.9.2
 python-multipart==0.0.12