Password transport contract

Password fields are sent as plain text inside HTTPS requests and are hashed with Argon2id before persistence. Client-side RSA password encryption has been removed.

This is a breaking contract change:

• clients must stop requesting /api/v1/auth/public-key;
• clients must remove RSA encryption and all isPasswordEncrypted, isCurrentPasswordEncrypted, and isNewPasswordEncrypted fields;
• login, user creation, password reset, password change, and first-login completion send their password fields directly over TLS;
• production and staging must terminate TLS 1.2+ at the application or a trusted ingress/load balancer and redirect HTTP to HTTPS.

Applications generated by the framework enable HTTPS redirection and HSTS outside Development. RequireHttpsMetadata remains enabled for JWT authentication metadata. Network-level TLS must additionally be validated in staging with DAST and an SSL scan.