Fix auth login logic: avoid password rehashing and token-gated auth

[dipok-1]

Summary

This PR fixes multiple login-related issues and improves the reliability of the authentication flow.

Notes

• This issue is related to PR bug: Login fails due to untrimmed whitespace in email/username #1900 — even after adding trim(), the 401 error still occurs.
• Prevents re-hashing passwords during login by using bcrypt.compare only.
• Removes the appxAuthToken requirement from password validation so login depends only on identity and password.
• Refactors the Signin form to use controlled useState instead of useRef to prevent stale input values during authentication.

These changes improve the correctness, stability, and predictability of the login flow.

Note (Infrastructure)

During local testing, authentication failures were traced to Prisma failing to initialize due to a missing database configuration:

Environment variable not found: DATABASE_URL

When this happens, NextAuth masks the underlying error and returns a CredentialsSignin (401) response even when the provided credentials are valid.

This is an environment/runtime configuration issue and is not addressed in this PR.