feat: add password authentication

[vinimachadosantana]

What

Adds bcrypt password hashing to User and a registration endpoint.

Why

The first half of auth, proving who someone is. Sessions and authorization build on it in the next PRs.

How

• has_secure_password hashes with bcrypt, which is deliberately slow so brute-forcing a stolen digest is expensive.
• A 12-character minimum with allow_nil: true, so updating an existing user doesn't demand a password.
• A spec asserts the response never contains password_digest, proving the serializer allowlist holds.

Testing

• Model and request specs green, including the 422 contract
• RuboCop and Brakeman clean