[Auth] Migrate registration, login, and profile flows to the new API

[Josan88]

Summary

Migrate the user-facing auth and profile flows into the Node.js + Express API and remove insecure legacy password handling.

Tasks

• Implement registration and login endpoints
• Hash passwords instead of storing or comparing plaintext values
• Implement profile read and profile update endpoints
• Remove API behaviors that expose the full email list or unauthenticated account lookup
• Keep authentication scope basic, as the brief excludes MFA and advanced authentication mechanisms

Done criteria

• New users can register and log in through the new API
• Stored passwords are hashed
• Profile fetch and update work for the authenticated user only
• The old email enumeration behavior is no longer needed

Reference

• Parent tracker: Implementation Tracker: BookRunner Azure DevOps Migration #1
• Project brief scope: basic username/password login and registration only
• Local API contract: GROUP/BookRunner API Contract.md