fix(api): omit password fields from user creation response (#8215)

Author: Gaotax2006

apps/api/src/services/userService.js

@@ -5,7 +5,8 @@ export async function listUsers() {
 }
 
 export async function createUser(payload) {
-  const user = { id: `usr_${Date.now()}`, ...payload };
+  const { password: _ignoredPassword, passwordHash: _ignoredHash, ...safePayload } = payload || {};
+  const user = { id: `usr_${Date.now()}`, ...safePayload };
   users.push(user);
   return user;
 }