fix: return 401 (not 500) when bcrypt hash is malformed (#21)

- verify_password catches ValueError from passlib so a mangled hash
  ($ signs stripped by shell/Docker) returns False instead of crashing
- Settings.check_password_hash logs a clear startup error with fix
  instructions when AUTH_PASSWORD_HASH doesn't start with '$2'

backend/app/core/security.py

@@ -9,7 +9,10 @@ pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
 
 
 def verify_password(plain: str, hashed: str) -> bool:
-    return bool(pwd_context.verify(plain, hashed))
+    try:
+        return bool(pwd_context.verify(plain, hashed))
+    except ValueError:
+        return False
 
 
 def hash_password(password: str) -> str: