Every credential provider says whether it still holds a consumer

holds() for postgres, mssql, mongodb, minio, lavinmq, mosquitto, mailu
and gitea, so the harness makes again a login the backend lost (hq issue
120). Each checks the mesh's password as the consumer presents it, or
compares it read-only, and returns false only when the backend says the
credential is absent or wrong; an unreachable backend throws.

modules/mssql/client.ts

@@ -142,6 +142,25 @@ export class MssqlClient {
     await this.exec(`ALTER ROLE db_owner ADD MEMBER ${ident(login)}`, database);
   }
 
+  /**
+   * Whether `login` exists, is enabled, has exactly `password`, and is a db_owner user of
+   * `database`. Read-only: the password is compared with PWDCOMPARE against the stored hash, so
+   * nothing logs in and no failed-login is recorded (novox/hq issue 120).
+   */
+  async holdsLogin(database: string, login: string, password: string): Promise<boolean> {
+    const server = await this.query(
+      `SELECT CAST(CASE WHEN EXISTS (SELECT 1 FROM sys.sql_logins WHERE name = ${literal(login)} ` +
+        `AND is_disabled = 0 AND PWDCOMPARE(${literal(password)}, password_hash) = 1) ` +
+        `AND DB_ID(${literal(database)}) IS NOT NULL THEN 1 ELSE 0 END AS int) AS ok`,
+    );
+    if (Number(server[0]?.ok) !== 1) return false;
+    const owner = await this.query(
+      `SELECT CAST(IS_ROLEMEMBER('db_owner', ${literal(login)}) AS int) AS ok`,
+      database,
+    );
+    return Number(owner[0]?.ok) === 1;
+  }
+
   /** Drop a database and its login, idempotently, after evicting live connections. */
   async dropDatabaseAndLogin(database: string, login: string): Promise<void> {
     const dbs = await this.query(