Users are stored in data/auth.db (admins manage them under Users). Legacy APP_USERS / APP_USER still work if enabled.
data/auth.db
APP_USERS
APP_USER