Exercise 3: The Third Confirmation in the Series — Possible Solution
====================================================================

CONFIRMING bcryptjs VERIFIES THE $2y$ HASH
------------------------------
Given the legacy admin's real stored hash (a $2y$-tagged bcrypt hash
produced by PHP's password_hash()), calling
bcrypt.compare(plainPassword, legacyHash) with the correct plaintext
password returns true, with no configuration change of any kind
needed on the bcryptjs side.

THE TWO EARLIER CHAPTERS WHERE THE SAME PACKAGE ALREADY DID THIS
------------------------------
Per this chapter, the Next.js rebuild's own Chapter 9 was the first
to use bcryptjs to verify this exact legacy hash, inside a NextAuth.js
Credentials provider. The Astro rebuild's own Chapter 9 confirmed the
identical package doing the identical job a second time, through its
own @auth/astro integration - the same underlying Auth.js library as
Next.js. This chapter is the third confirmation, using bcryptjs
directly with no framework wrapper around it at all.

WHY THIS WORKS AS AN ANSWER
------------------------------
It correctly confirms bcryptjs verifies the $2y$-tagged hash with no
configuration, and correctly names the Next.js and Astro rebuild
courses as the two earlier places in the series where the identical
npm package already performed the same verification.