Function verify_secret 

pub fn verify_secret(
    stored_hash: &str,
    presented: &str,
    pepper: Option<&[u8]>,
) -> bool

Verify a presented secret against a stored hash, in constant time for the fast paths (subtle::ConstantTimeEq over the encoded digests — comparing hex strings byte-wise is length-equal and timing-uniform). Supported formats: hmac-sha256:<hex> (#124; verified ONLY when a pepper is configured — a missing pepper fails closed for peppered entries), legacy sha256:<hex> (always verified, pepper or not: the transition keeps old rows valid), and PHC argon2id strings ($argon2id$..., pepper-independent). Unknown formats verify false (never accept).

Public for testing the stored-hash verification contract.