Falls back to validating against the user's active app passwords when
the primary password match fails and no JWT is presented. Supports both
p= (plaintext / enc:) and t=/s= (token+salt md5) shapes, uses
crypto/subtle for constant-time comparison, and updates last_used_at
asynchronously after a successful match.
Lets Subsonic clients (DSub, play:Sub, Symfonium, Feishin, etc.)
authenticate with named per-application secrets instead of the primary
account password.
42e4068c52