The place I am looking for may be narrowed down as the last place in the call stack that the password still occurs in unencrypted form (that is, as entered by the user). It's at that point that I would insert code that would verify that password with respect to the old database and set it as the user's ordinary password (now in accordance to Presta's encryption procedures and database location), so that regular Presta authentication would then proceed without disruption.
Anyone?