Rehash password on login when Argon2 params changeVerified

authenticate-password re-hashes a user's stored hash to the current config
:argon2 policy on successful login (params differ either way), so retuning the
cost factor migrates existing hashes transparently. + password-needs-rehash-p.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>