Function server_auth_handshake 

pub async fn server_auth_handshake<S>(
    stream: &mut S,
    expected_user: Option<&str>,
    expected_pass: Option<&str>,
) -> Result<String, ProtocolError>
where
    S: AsyncRead + AsyncWrite + Unpin,

Perform the server-side auth handshake: read credentials, validate, respond.

Returns the redacted auth representation user:**** (never the password) so callers can log it without leaking credentials. The full raw bytes are only retained for the duration of the auth phase and then dropped.