feat(auth): auto-upgrade every legacy password format to bcrypt on login

checkLogin now verifies and migrates all known password formats without
configuration: bcrypt, argon2id/argon2i/argon2d, unsalted md5/sha1/sha256/
sha512, double-md5 (UberCMS/Butterfly), salted md5 with embedded salt
(hash:salt, salt:hash, hash$salt), and a guarded plaintext fallback.

Every successful legacy login rewrites the stored hash to bcrypt, so the
CONVERT_PASSWORDS flag is no longer required (kept for deploy compatibility).

.env.example

@@ -36,8 +36,9 @@ BADGE_URL=/swf/c_images/album1584
 # --- SECURITY & HASHING ---
 AUTH_SECRET=your-super-secret-auth-key-change-this-min-32-chars
 APP_KEY=base64:your-app-key-here=
-CONVERT_PASSWORDS=true
-# CONVERT_PASSWORDS: enables legacy md5/argon2id -> bcrypt upgrade on login.
+# Deprecated: legacy md5/argon2id hashes are ALWAYS upgraded to bcrypt on
+# login now. Kept only for config compatibility with existing deploys.
+# CONVERT_PASSWORDS=true
 BCRYPT_COST=12
 
 # --- PATHS ---