refractor(auth): removed password from everywhere

docs/ARCHITECTURE.md

@@ -25,7 +25,6 @@ generate public read-only intervention links.
 ## Runtime Model
 - Auth uses bearer tokens from `api_tokens`.
 - OTP login uses `otp_challenges` and Mailpit in local dev.
-- Password hash uses PBKDF2-HMAC-SHA256. Legacy `sha256$` hashes rejected.
 - DB access uses raw parameterized SQL through `drogon::orm::DbClient`.
 - No Drogon generated ORM models. No `Mapper<T>`.
 
@@ -37,7 +36,6 @@ generate public read-only intervention links.
 Effective permission helpers:
 - `auth::canManageReports(user)`: admin or `reports.manage`
 - `auth::canOperateReports(user)`: non-admin report manager
-- `auth::mustChangePassword(user)`: blocks protected operational/admin flows
 
 ## Workflow Ownership Rules
 - `reports.assigned_operator_id` is single platform owner of report.