Bcrypt, scrypt or argon2 for a new project

Argon2id with the current OWASP parameters, and bcrypt only when a library constraint forces it. What matters more than the choice is that the cost parameter is revisited: a setting tuned five years ago is now cheap to attack.

The reporting layer, until something forces it. It is the part that feels productive to build and the part nobody opens twice.