fix(auth) : use dedicated plainPassword field for password hashing

- Add non-persisted plainPassword field to User entity (write-only via API)
- Remove direct write access to password field
- Update UserPasswordHasherProcessor to hash from plainPassword
- Update frontend DTO and UserDrawer component

Ticket: T-009

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/State/UserPasswordHasherProcessor.php

@@ -29,10 +29,11 @@ final readonly class UserPasswordHasherProcessor implements ProcessorInterface
      */
     public function process(mixed $data, Operation $operation, array $uriVariables = [], array $context = []): mixed
     {
-        $plainPassword = $data->getPassword();
+        $plainPassword = $data->getPlainPassword();
 
-        if (null !== $plainPassword && !str_starts_with($plainPassword, '$')) {
+        if (null !== $plainPassword && '' !== $plainPassword) {
             $data->setPassword($this->passwordHasher->hashPassword($data, $plainPassword));
+            $data->setPlainPassword(null);
         }
 
         return $this->persistProcessor->process($data, $operation, $uriVariables, $context);