fix(05): CR-03 hide User password and require secret columns in Hidden()

models/user.go

@@ -4,12 +4,15 @@ package models
 type User struct {
 	ID                 uint   `gorm:"column:id;primaryKey"`
 	Email              string `gorm:"column:email"`
-	Password           string `gorm:"column:password"`
+	Password           string `gorm:"column:password" json:"-"`
 	MustChangePassword bool   `gorm:"column:must_change_password"`
 }
 
 func (User) TableName() string { return "users" }
 
+// Hidden mirrors PHP User::$hidden for the columns this stub carries (D-08).
+func (User) Hidden() []string { return []string{"password"} }
+
 func init() {
 	Register(User{})
 }