Login takes seconds: Actions with network calls, Rules ordering, timeouts

# Diagnose: slow login

## Symptom

Login works but feels broken: 3-10 second delay between submit and callback.

## Likely causes

1. Actions making HTTP calls per login (enrichment APIs, CRM lookups) with no timeout or cache. Two Actions each calling out serially doubles it.
2. Legacy Rules with the same pattern, plus Rules run before Actions in mixed pipelines.
3. Custom database scripts with slow bcrypt rounds or external calls.
4. Social/enterprise IdP latency (out of your control, but measurable).

## Confirm

- Actions > your Action > Real-time Logs: run a test login and watch execution time per Action.
- Tenant logs: compare the login event's `date` with the authorize start; the gap is pipeline time.
- Disable Actions one by one (or run the flow with the Action removed) and re-time. Binary search the slow one.

## Fix

- Cache enrichment data (per user, TTL hours) instead of fetching per login.
- Set aggressive timeouts on outbound calls (2-3s) and fail open or closed deliberately, not by hanging.
- Move non-critical work (analytics, CRM sync) to a post-login async path or a log-stream-triggered job, not the login pipeline.
- Migrate remaining Rules to Actions; the mixed pipeline adds overhead.

## Verify

Time three consecutive logins; p95 under ~1.5s for database connections. Keep the timing check in your release checklist whenever an Action changes.