feat: stop keeping buspro password hash in the session

src/BusProNet/ApiClient.php

@@ -74,8 +74,8 @@ class ApiClient
      * this write: an address can hold several persons, and only "idadresseperson" names the
      * person, while "email" is ignored. The ids must therefore only ever come from a verified
      * source - MyE&P userinfo or a BusPro answer - never from a form or a request parameter.
-     * Element order as verified on the BusPro test system, see
-     * .ddev/plans/myep-team-oauth-only-login.md.
+     * Verified on the BusPro test system (2026-10-16): BusPro accepts "login" on KUNDENKONTO
+     * requests made with our API credentials.
      *
      * @throws ApiClientException
      * @throws ResponseParserException

src/Security/BpnAuthenticator.php

@@ -73,7 +73,7 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
         $csrfToken = $request->request->getString('_csrf_token');
 
         return new SelfValidatingPassport(
-            new UserBadge($email, function () use ($email, $password, $request) {
+            new UserBadge($email, function () use ($email, $password) {
                 try {
                     $response = $this->apiClient->getProfile($email, $password);
                 } catch (ApiClientException $e) {
@@ -91,9 +91,6 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
                     return null;
                 }
 
-                // Store BPN password in session for later use
-                $request->getSession()->set('bpn_password', $password);
-
                 return $user;
             }),
             [