Security: Sanitize and limit login response - avoid leaking password hash in /api/auth/login

[adityack477]

The login route returns req.user directly to the client. The Mongoose User object includes the hashed password field. The response should omit sensitive fields (password, __v) before sending to the client.