If the server checked against a client-provided hash, <i>the hash would become the password</i>, and the attacker could just use the hash as-is to login to the server. Hashing on the client solves nothing.