10.2.5 `unknown username` won't be returned

Nobody has claimed this yet.

Since we use a default PHC string to make the verifying time-constant, the actual `Unknown Username` case will be early returned as `Invalid password`.
```rust
spawn_blocking_with_tracing(move || {
verify_password_hash(expected_password_hash, credentials.password)
})
.await
// early return
.context("Failed to spawn blocking task.")??;
user_id
// dead code
.ok_or_else(|| anyhow::anyhow!("Unknown username."))
.map_err(AuthError::InvalidCredentials)
```

Start at the authentication entry point containing the shown spawn_blocking_with_tracing call, then inspect verify_password_hash and the user_id handling around it. Reproduce the unknown-username case and verify that it returns the intended unknown-username error instead of Invalid password while preserving the constant-time verification behavior.

Written by the indexing model from the issue text.