use FakePasswordHasher in tests to eliminate bcrypt cost

Add a trivial prefix-based PasswordHasher fake and inject it into the
three test files that exercise CreateUser or AuthenticateUser. Drops
the full phpunit suite from ~7.4s to ~30ms (about 224x) without
losing coverage: the round-trip through hash/verify still validates
that CreateUser stores something other than the plaintext and that
AuthenticateUser only succeeds on a matching hash.

CreateUserTest is also refactored to use a setUp method, matching
the pattern already used in AuthenticateUserTest and AuthControllerTest.

tests/Fakes/FakePasswordHasher.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace Tests\Fakes;
+
+use App\Auth\PasswordHasher;
+
+class FakePasswordHasher implements PasswordHasher
+{
+    private const PREFIX = 'hashed:';
+
+    public function hash(string $plaintext): string
+    {
+        return self::PREFIX . $plaintext;
+    }
+
+    public function verify(string $plaintext, string $hash): bool
+    {
+        return $hash === self::PREFIX . $plaintext;
+    }
+}