fix(auth): add username + passwordHash fields to users collection

The production UsersRepository reads and writes username + passwordHash
via the Payload local API, but the users collection never declared them,
so production sign-up/sign-in was broken (audit finding B1). passwordHash
uses access.read: () => false so credential material never serializes
through any Payload API surface; the repository still reads it with
overrideAccess: true. A contract-shaped test pins every repo-used field
(USERS_REPOSITORY_FIELDS) against the collection config so drift fails
at test time without a database.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

compliance/data-map.yml

@@ -32,4 +32,11 @@ collections:
           - transactional-notifications
         restrictable: true
         source: auth-default
+      - category: identification-username
+        exportable: true
+        field: username
+        purpose:
+          - service-delivery
+        restrictable: true
+        source: field-tag
     slug: users