SEC-88 · P1 · Auth service regressions
Security scan flagged that passwords appear in plain text in the users collection and that /register returns the password field in its response. Meanwhile support says nobody can log in, and users who registered with a capitalised email can't log in at all. Even freshly issued tokens are rejected by GET /me.
Definition of done: all tests in tests/auth.test.js pass. Keep the API contract unchanged.