Generic 'Identifiants invalides.' is now returned for both wrong password and missing-password-set cases (security obscurity, prevents account enumeration). Tests still asserted the granular 'Mot de passe incorrect.' message and a 403 status that the controller no longer emits. Co-Authored-By: RuFlo <ruv@ruv.net>