Function verify_credentials 

async fn verify_credentials(
    services: &Services,
    username: &str,
    password: &str,
    address: Result<RateLimitIp, (StatusCode, &'static str)>,
) -> Result<OwnedUserId>

Authenticate a local account by password, mirroring the /login password flow (password_login).

Refused while password login is disabled. Only password-origin accounts pass, and every credential failure returns one uniform error.