perf: optimize hash-to-G1 in the highly 2-adic Fp case

internal/generator/hash_to_curve/template/pkg_sswu.go.tmpl

@@ -222,33 +222,26 @@ func {{$CurveTitle}}SqrtRatio(z *{{$CoordType}}, u *{{$CoordType}}, v *{{$CoordT
 	var x {{$CoordType}}
 	x.Mul(u, v)
 
-	// w = x^((m-1)/2) = (u*v)^((m-1)/2)
+	// Determine QR/QNR via Legendre symbol (fast binary GCD, no exponentiation).
+	// This avoids a wasted ExpBySqrtExp call when u/v is a non-residue.
+	// (u/v | p) = (u*v | p) since (v² | p) = 1.
+	isQNr := x.Legendre() != 1
+	isQNrInt := uint64(0)
+	if isQNr {
+		isQNrInt = 1
+		// We compute sqrt(Z*u/v) = sqrt(Z*u*v) / v instead
+		{{$CurveTitle}}MulByZ(&x, &x) // x = Z*u*v
+	}
+
+	// Single exponentiation on the correct input
 	var w {{$CoordType}}
 	w.ExpBySqrtExp(x)
 
-	// xM = x^m = x * w^2 = (u*v)^m
+	// xM = x^m = x * w^2
 	var xM {{$CoordType}}
 	xM.Square(&w)
 	xM.Mul(&xM, &x)
 
-	// Check if u/v is QR by checking if (u*v)^m has order dividing 2^(e-1)
-	// Note: (u/v | p) = (u*v | p) since (v^(-1) | p) = (v | p) for Legendre symbols
-	t := xM
-	for range {{$CurveName}}SarkarN-1 {
-		t.Square(&t)
-	}
-	isQNr := !t.IsOne() // t should be ±1; if -1 then u/v is not QR
-	isQNrInt := uint64(0)
-	if isQNr {
-		isQNrInt = 1
-		// If not QR, we compute sqrt(Z*u/v) = sqrt(Z*u*v) / v instead
-		// x already holds u*v, so we just multiply by Z
-		{{$CurveTitle}}MulByZ(&x, &x)     // x = Z*u*v
-		w.ExpBySqrtExp(x)                  // w = (Z*u*v)^((m-1)/2)
-		xM.Square(&w)
-		xM.Mul(&xM, &x)                    // xM = (Z*u*v)^m
-	}
-
 	// Precompute xM^(2^i) for i = 0..e-1
 	var xPow [{{$CurveName}}SarkarN]{{$CoordType}}
 	xPow[0] = xM