WebAuth cannot login with Username-Password-Authentication; Identity works fine

From a review of the HAR file and the tenant configuration the issue is that you have an incorrectly configured custom login page.

In particular, where one would expect to have Lock in the custom hosted login page configured like:

      auth: {
        redirectUrl: config.callbackURL,
        responseType: (config.internalOptions || {}).response_type ||
          (config.callbackOnLocationHash ? 'token' : 'code'),
        params: config.internalOptions
      },

your current configuration has:

      auth: {
        redirect: false,
        responseType: (config.internalOptions || {}).response_type ||
          (config.callbackOnLocationHash ? 'token' : 'code'),
        params: config.internalOptions
      },

Notice that the incorrect configuration has redirect: false, when it should be redirectUrl: config.callbackURL,.