test(auth): add unit tests for auth.service and fix passport local strategy done() call

[PierreBrisorgueil]

Problem

• auth.service.js has zero unit tests — all six functions (removeSensitive, comparePassword, hashPassword, authenticate, checkPassword, generateRandomPassphrase) are untested in isolation
• The passport local strategy catches an error and calls done() with no arguments, which is incorrect — it should call done(null, false, { message }) to properly signal authentication failure to passport

Expected behaviour

• All six auth.service.js functions covered by unit tests (mocking UserRepository, bcrypt, zxcvbn)
• Passport local strategy correctly communicates false (not an error) when credentials are invalid