✨ New Features

• Hashed passwords in SimpleAuthenticator – stored passwords may now be crypt-format hashes (anything password_hash() produces) and can be freely mixed with plain-text ones. The format is detected automatically, so hashes just work in the security: users: config section with no extra option. A hash whose algorithm the PHP build doesn't know fails closed instead of being compared as plain text, and plain-text comparison is timing-safe.
• Passwords::bcrypt() and Passwords::argon2id() – name the algorithm instead of juggling PASSWORD_* constants and options arrays: Passwords::bcrypt(12) or Passwords::argon2id(memoryCost: 65536). Omitted parameters keep PHP's defaults, and argon2id() fails with a clear exception on builds without Argon2 support.
• ACL rules in the configuration – the new rules section lets you define permissions declaratively next to your roles and resources:

  security:
      rules:
          allow:
              - [guest, article, view]
              - [registered, comment, [add, edit]]
              - [admin]
          deny:
              - [banned, comment, add]

  Each rule is [role(s), resource(s), privilege(s)]; an omitted or null item means "all", and a bare string grants or revokes everything for that role. Malformed rules are rejected at config time, not at runtime.

🐛 Bug Fixes

• logout() no longer touches the storage when there is nothing to change, so logging out a guest doesn't needlessly regenerate the session ID or overwrite the logout reason. A stored authentication vetoed by wakeupIdentity() (a revoked token, say) is still properly cleared.
• Permission::isAllowed() now saves and restores the queried role and resource, making it re-entrant and exception-safe – an assertion callback can call isAllowed() again without corrupting the results of the outer query.