feat(security): argon2id password hashing and AES for SignRSA secrets

- Hash driver read from HASH_DRIVER (argon2id in production); bcrypt
  hashes still verify and are rehashed on successful admin/client login
  since the JWT guard and guard->validate() never rehash on their own.
- Client registration uses Hash::make instead of bcrypt(), which always
  forced bcrypt regardless of the configured driver.
- SignRSA now encrypts with Crypt (AES-256-CBC + HMAC, APP_KEY) instead
  of 3DES in ECB mode without IV. Legacy 3DES values are still readable
  via RSA_KEY/RSA_PUBLIC until `secrets:reencrypt` migrates them;
  RSA_PRIVATE is no longer used.
- LegacyPortalImporter stored module_vmware.password in plaintext; it is
  now encrypted, and a migration encrypts existing plaintext rows.

Deploy: php artisan migrate, then secrets:reencrypt --dry-run and
secrets:reencrypt; remove RSA_* from env once it exits 0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/Services/Api/Client/ClientAuthService.php

@@ -72,6 +72,8 @@ class ClientAuthService
             ]);
         }
 
+        $guard->getProvider()->rehashPasswordIfRequired($client, $credentials);
+
         return $client;
     }
 
@@ -98,7 +100,7 @@ class ClientAuthService
             'fullname'                    => $data['fullname'],
             'phone'                       => $data['phone'] ?? null,
             'email'                       => $data['email'],
-            'password'                    => bcrypt($data['password']),
+            'password'                    => Hash::make($data['password']),
             'status'                      => 0,
             'email_verify_code'           => $code,
             'email_verify_code_expired_at' => now()->addMinutes(5),