Spec password storage for a service with legacy hashes

Your new TypeScript auth service is replacing a 10-year-old PHP app. The old app stored passwords as unsalted SHA-1 hashes, and 2 million users still have one. An agent will write the new code that stores and checks passwords. You cannot force everyone to reset.

Write the spec you would hand the agent.

What you know:

• Node 22 and Postgres, with a users table that has a password_hash text column
• sign-in runs on 4 small containers with 1 GB of memory each
• the security team allows the argon2 npm package
• the old hashes are 40 lowercase hex characters, made by PHP's sha1(), with no prefix

Then, in a few sentences: what does "hash and check the user's password" tend to produce?