fix(client-service): hide service/vm ids, mask vm password, encrypt module_vmware.password

- detail response drops id and vm.id/vmware_id, password returns *****
- GET client-service/{uuid}/vm-password returns the decrypted password to the owner
- renew accepts service uuid
- EncryptedOrLegacy cast for module_vmware.password
- vps specs: addon ram is stored in MB, convert to GB

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

app/Casts/EncryptedOrLegacy.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace App\Casts;
+
+use Illuminate\Contracts\Database\Eloquent\CastsAttributes;
+use Illuminate\Contracts\Encryption\DecryptException;
+use Illuminate\Support\Facades\Crypt;
+
+class EncryptedOrLegacy implements CastsAttributes
+{
+    public function get($model, string $key, $value, array $attributes)
+    {
+        if ($value === null || $value === '') {
+            return $value;
+        }
+
+        try {
+            return Crypt::decryptString($value);
+        } catch (DecryptException) {
+            return $value;
+        }
+    }
+
+    public function set($model, string $key, $value, array $attributes)
+    {
+        return $value === null || $value === '' ? $value : Crypt::encryptString($value);
+    }
+}