fix: log a failed password migration instead of swallowing it

The round-2 review noted that `_upgrade_password` catches `PyMongoError`
without logging it. A failed upgrade is harmless to the login itself - the
user still gets in - but it leaves the password stored in plain text, and
that is exactly the kind of thing an operator needs to know about. It is now
logged as a warning with the username and the traceback.

A test covers the path: the migration write is forced to fail, the login
still succeeds, and the warning is emitted.

tests/test_app.py

@@ -215,6 +215,29 @@ def test_legacy_plaintext_password_is_accepted_and_migrated(repo):
     assert "password_migrated_at" in doc
 
 
+def test_a_failed_password_migration_still_lets_the_login_succeed(repo, caplog):
+    """If the upgrade write fails, the login must still work — but the
+    failure is logged so the operator knows the password is still plaintext."""
+    import logging
+
+    from pymongo.errors import PyMongoError
+
+    repo.users.insert_one({"username": "beer", "password": "beer_pass"})
+
+    def boom(*args, **kwargs):
+        raise PyMongoError("write failed")
+
+    original = repo.users.update_one
+    repo.users.update_one = boom
+
+    with caplog.at_level(logging.WARNING):
+        assert repo.user_check("beer", "beer_pass") is True
+
+    repo.users.update_one = original
+
+    assert any("plain text" in rec.message for rec in caplog.records)
+
+
 def test_hashed_password_verifies(repo):
     from mongo.repository import hash_password