Scenario 9: Right after deployment, every newly registered user can never log in, even immediately after signing up with the exact password they chose.

This is the classic missing passwordEncoder.encode() bug at registration — the raw password is stored as-is, so PasswordEncoder.matches(raw, storedValue) fails during login because the stored value doesn't look like a valid hash. Fix by encoding the password at the single point of entry (registration/password-change) and verify existing broken accounts by forcing a password reset, since their stored values can't be un-corrupted after the fact.