Covers the case where authMode is 'password' and deviceIdentity is present.
Asserts that buildDeviceAuthPayload is called with token:null (not the password
value) and that the connect request uses auth.password, not auth.token.
Addresses Copilot review comment on PR #22.