Function authenticate_by_password 

async fn authenticate_by_password(
    conn: &mut PgConnection,
    user_id: Uuid,
    email: &str,
    password: &SecretString,
    app_conf: &ApplicationConfiguration,
) -> Result<bool, ControllerError>

Verifies password for user_id, trying the seeded test-mode credentials before falling back to the stored password hash.

Seeded test users (e.g. admin@example.com) have no user_passwords row, so outside test mode this always falls through to verify_user_password.