feat(security): argon2id password hashing and AES for SignRSA secrets

- Hash driver read from HASH_DRIVER (argon2id in production); bcrypt
  hashes still verify and are rehashed on successful admin/client login
  since the JWT guard and guard->validate() never rehash on their own.
- Client registration uses Hash::make instead of bcrypt(), which always
  forced bcrypt regardless of the configured driver.
- SignRSA now encrypts with Crypt (AES-256-CBC + HMAC, APP_KEY) instead
  of 3DES in ECB mode without IV. Legacy 3DES values are still readable
  via RSA_KEY/RSA_PUBLIC until `secrets:reencrypt` migrates them;
  RSA_PRIVATE is no longer used.
- LegacyPortalImporter stored module_vmware.password in plaintext; it is
  now encrypted, and a migration encrypts existing plaintext rows.

Deploy: php artisan migrate, then secrets:reencrypt --dry-run and
secrets:reencrypt; remove RSA_* from env once it exits 0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

database/migrations/2026_10_15_000009_encrypt_legacy_module_vmware_passwords.php

@@ -0,0 +1,29 @@
+<?php
+
+use App\Http\Facade\SignRSA;
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        DB::table('module_vmware')
+            ->select(['id', 'password'])
+            ->whereNotNull('password')
+            ->where('password', '!=', '')
+            ->chunkById(200, function ($rows) {
+                foreach ($rows as $row) {
+                    if (SignRSA::DecryptFunc($row->password) !== '') {
+                        continue;
+                    }
+
+                    DB::table('module_vmware')->where('id', $row->id)->update(['password' => SignRSA::EncryptFunc($row->password)]);
+                }
+            });
+    }
+
+    public function down(): void
+    {
+    }
+};