test(auth): add unit tests for bcrypt password helpers

5 tests covering roundtrip, wrong password, salt uniqueness, garbage
hash resilience, and empty password.

tests/unit/domains/auth/test_passwords.py

@@ -0,0 +1,34 @@
+"""Tests for app.domains.auth.passwords (bcrypt direct, no passlib)."""
+import pytest
+
+from app.domains.auth.passwords import hash_password, verify_password
+
+
+def test_hash_and_verify_roundtrip():
+    h = hash_password("correcthorsebatterystaple")
+    assert isinstance(h, str)
+    assert h != "correcthorsebatterystaple"
+    assert verify_password("correcthorsebatterystaple", h) is True
+
+
+def test_verify_wrong_password():
+    h = hash_password("rightpw")
+    assert verify_password("wrongpw", h) is False
+
+
+def test_hash_is_unique_per_call():
+    h1 = hash_password("same")
+    h2 = hash_password("same")
+    assert h1 != h2
+    assert verify_password("same", h1)
+    assert verify_password("same", h2)
+
+
+def test_verify_garbage_hash_returns_false():
+    assert verify_password("anything", "not-a-bcrypt-hash") is False
+
+
+def test_hash_empty_password():
+    h = hash_password("")
+    assert verify_password("", h) is True
+    assert verify_password("nonempty", h) is False