refractor(auth): removed password from everywhere

docs/API_SPEC.md

@@ -30,15 +30,11 @@ Authorization: Bearer <token>
 
 ## Auth + Profile
 - `POST /auth/register`
-  citizen registration
+  citizen registration without password
 - `POST /auth/otp/request`
   sends OTP through Mailpit
 - `POST /auth/otp/verify`
   consumes OTP, returns bearer token
-- `POST /auth/login/password`
-  password fallback login
-- `POST /auth/change-password`
-  authenticated password change, also clears `must_change_password`
 - `GET /me`
   current user profile, roles, permissions, points
 - `PATCH /me`