perf(api): move blocking file and hash work off the event loop

Run session-tracks serialization, request cache IO, session cache dir removal (now outside the store lock), history reads and gzip over 1 MiB on worker threads; cache the per-key PBKDF2 namespace and key_id.

tests/remote/unit/test_compression.py

@@ -62,3 +62,25 @@ def test_compresses_large_json_when_accepted() -> None:
     decompressed = gzip.decompress(resp.body)
     assert json.loads(decompressed) == big
     assert resp.content_length == len(resp.body)
+
+
+def test_compresses_a_body_over_the_thread_size_on_a_worker_thread(monkeypatch) -> None:
+    from unshackle.core.api import compression
+
+    threaded = []
+    real = asyncio.to_thread
+
+    async def to_thread(fn, *args, **kwargs):
+        threaded.append(fn)
+        return await real(fn, *args, **kwargs)
+
+    monkeypatch.setattr(compression.asyncio, "to_thread", to_thread)
+    monkeypatch.setattr(compression, "GZIP_THREAD_SIZE", 1024)
+    big = {"data": "x" * 4096}
+
+    async def handler(req):  # noqa: ARG001
+        return web.json_response(big)
+
+    resp = run(compression_middleware(_FakeReq(), handler))
+    assert threaded == [gzip.compress]
+    assert json.loads(gzip.decompress(resp.body)) == big