Email and password: login

[ParallelEntrepreneur]

Part of #1.

Blocked by: #19 (Email and password: registration with argon2)

Problem. Login must verify in constant time against an existing hash, resist enumeration, and honour the lockout.

Proposed approach. POST /password/login { email, password }: rate limits and captcha first; look up the password credential; when absent, verify against a fixed dummy hash so timing does not differ; on success issue a session and, if the stored hash's parameters are older than the current ones, rehash and update. Failures increment the lockout counter; the response body is identical for wrong password, unknown email and locked account, with the lockout distinguishable only by Retry-After once the limit is hit.

Acceptance criteria

• Correct password issues a session; wrong password, unknown email and disabled account produce identical bodies
• Dummy-hash path exercised in a test
• Rehash-on-login tested with an old parameter set
• Lockout interaction tested with the rate-limiting issue's fakes

[ParallelEntrepreneur]

Delivered by #42 (35e207a), merged to main. Password login is shipped, with the module's suite and the shared conformance kit green in CI.

Closing on the merge rather than leaving it open: the PR did not carry a closing keyword, so this never linked automatically.