`verify_password` raises `UnknownHashError` on malformed stored hashes instead of returning False

[Aburke225]

core/security.py lets passlib's UnknownHashError escape when the stored hash is not a recognizable format. Verification against a malformed hash should fail closed (return False), not raise.

The covering test is marked @pytest.mark.xfail referencing manifest id H-05 — remove the marker as part of the fix.

Relevant files:

• core/security.py
• tests/unit/test_security.py

Estimated effort: 1–2 hours