fix(client-service): hide service/vm ids, mask vm password, encrypt module_vmware.password

- detail response drops id and vm.id/vmware_id, password returns *****
- GET client-service/{uuid}/vm-password returns the decrypted password to the owner
- renew accepts service uuid
- EncryptedOrLegacy cast for module_vmware.password
- vps specs: addon ram is stored in MB, convert to GB

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

app/Models/ModuleVmware.php

@@ -39,11 +39,8 @@ class ModuleVmware extends Model
         'disk_gb',
     ];
 
-    // NOTE: password must NOT use 'hashed' cast — it is a VM guest credential
-    // used in plaintext by PowerShell scripts (Invoke-VMScript) via SSH/PowerCLI.
-    // plain_password uses Laravel's 'encrypted' cast (APP_KEY, AES-256-CBC): stored
-    // encrypted at rest, transparently decrypted on read — no code elsewhere changes.
     protected $casts = [
+        'password' => \App\Casts\EncryptedOrLegacy::class,
         'plain_password' => 'encrypted',
     ];
     public function customer()