feat: bcrypt password hashing in authService

[0xhermes-28]

Fixes #11559

• registerUser hashes password with bcryptjs (12 rounds), stores in-memory map
• loginUser verifies password against hash, throws "Invalid email or password"
• refreshToken(req.user.sub, req.user.role) uses verified identity
• Added bcryptjs dependency + authService tests (register, login, wrong pass, not found)
  /bounty $50