🔧 Extract password hashing to lib/helpers to break the users↔auth service cycle

[PierreBrisorgueil]

Problem

modules/users/services/users.service.js calls AuthService.hashPassword / comparePassword, while modules/auth/services/auth.service.js imports UsersService (to look up a user by email) — forming a circular dependency between the auth and users services. It works today by module load order, but it is fragile.

Fix

Extract the two thin bcrypt wrappers (hashPassword, comparePassword) into a dependency-free shared helper lib/helpers/password.js. Both auth.service.js and users.service.js import from lib/ instead of each other.

Acceptance

• No auth↔users service import cycle.
• hashPassword / comparePassword live in lib/helpers/password.js.
• Auth + users tests green.

Created via /dev:issue