pub fn hash_password(password: &str) -> AppResult<String>
Hashes a password with Argon2id (OWASP recommended default parameters).