feat: implement bcrypt password hashing

backend/auth/password.py

@@ -1 +1,9 @@
-# bcrypt hash + verify — implemented in Phase 2
+import bcrypt
+
+
+def hash_password(plain: str) -> str:
+    return bcrypt.hashpw(plain.encode(), bcrypt.gensalt(rounds=12)).decode()
+
+
+def verify_password(plain: str, hashed: str) -> bool:
+    return bcrypt.checkpw(plain.encode(), hashed.encode())

tests/test_password.py

@@ -0,0 +1,23 @@
+from backend.auth.password import hash_password, verify_password
+
+
+def test_hash_returns_string():
+    result = hash_password("secret123")
+    assert isinstance(result, str)
+    assert result != "secret123"
+
+
+def test_verify_correct_password():
+    hashed = hash_password("mypassword")
+    assert verify_password("mypassword", hashed) is True
+
+
+def test_verify_wrong_password():
+    hashed = hash_password("mypassword")
+    assert verify_password("wrongpassword", hashed) is False
+
+
+def test_same_password_different_hashes():
+    h1 = hash_password("same")
+    h2 = hash_password("same")
+    assert h1 != h2  # bcrypt uses random salt