PBKDF2 password verification

Implement a password verifier using PBKDF2-HMAC-SHA256. Given a stored record string of the form 'pbkdf2_sha256$<iterations><salt_hex><hash_hex>' and a candidate password, return True if the password reproduces the stored hash. Derive the key with hashlib.pbkdf2_hmac('sha256', password_bytes, salt_bytes, iterations) where salt is the hex-decoded salt and the result is compared using a constant-time comparison. Return False if the record is malformed (wrong number of '$'-separated fields or wrong algorithm tag).