function verifyUserPassword verifyUserPassword(user: User,password: string,): Promise<string | null> Verify a user's password (decrypt stored hash, then verify) Returns the decrypted password hash if valid (needed for KEK derivation) Parameters user: User password: string Return Type Promise<string | null>