feat: local password hashes

docs/technical-documentation.md

@@ -846,24 +846,22 @@ CompositeCondition::or(
 
 **Location:** `src/Security/BpnAuthenticator.php`
 
-Custom authenticator that validates credentials against BusProNet API.
+Custom authenticator that validates credentials against the local Symfony password hash.
 
 ```
-Login Form → MD5 Hash Password → ApiClient::getPersonalData()
+Login Form → Verify local password hash
     │
-    ├─ Valid → Create/Update User Entity
-    │          Get CRM Attributes (roles, hotel codes)
-    │          Encrypt password with RSA
-    │          Store in database
+    ├─ Valid → Update login timestamp
+    │          Migrate legacy encrypted password on first success
     │
     └─ Invalid → CustomUserMessageAuthenticationException
 ```
 
 #### User Entity Password Handling
 
-- Plain password hashed with MD5 for API authentication
-- MD5 hash encrypted with RSA before database storage
-- Decrypted when needed for subsequent API calls
+- Password column stores the Symfony hash after migration
+- Existing legacy rows may still contain the old encrypted BPN password until the user logs in once
+- BPN customer-data requests use `login=J` plus `email` and address/person identifiers
 
 ### 7.2 Encryption
 
@@ -928,7 +926,7 @@ api:
 | Property | Type | Purpose |
 |----------|------|---------|
 | `email` | string (unique) | User identifier |
-| `password` | string (nullable) | RSA-encrypted API password |
+| `password` | string (nullable) | Symfony password hash, with legacy encrypted value only during migration |
 | `personId` | int (nullable) | BusProNet person ID |
 | `addressId` | int (nullable) | BusProNet address ID |
 | `roles` | array (JSON) | CRM roles |