pub fn hash_password(password: &str) -> Result<String, String>
Hash a password using Argon2id (RFC 9106).
Returns an error string if hashing fails.