Why must you always call passwordEncoder.encode() during user registration?

PasswordEncoder.matches(raw, encoded) expects the stored value to be an encoded hash. If registration stores a raw plain-text password instead, the stored value no longer looks like a valid hash to the encoder, so every subsequent login attempt will fail matches() even with the exact correct password — this is one of the most common 'why can't users log in after signing up' production bugs.