fix: prevent sensitive fields from leaking in user API responses (#14792)

Closes #14789

### What problem does this PR solve?

User API endpoints (`login`, `user_profile`, `user_add`,
`forget_reset_password`) were returning full user objects via
`to_json()` / `to_dict()`, which included sensitive fields like
`password` and `access_token` in the response body. This leaks
credentials to the client.

This PR adds a `to_safe_dict()` method on the `User` model that strips
sensitive fields (`password`, `access_token`) and replaces all affected
call sites to use it.

### Type of change

- [x] Bug Fix (non-breaking change which fixes an issue)

test/testcases/restful_api/test_user_tenant_routes_unit.py

@@ -392,6 +392,13 @@ class _DummyUser:
     def to_dict(self):
         return {"id": self.id, "email": self.email}
 
+    def to_safe_dict(self, *, for_self: bool = False):
+        _sensitive = {"password", "access_token", "email"}
+        result = {k: v for k, v in self.to_dict().items() if k not in _sensitive}
+        if for_self:
+            result["email"] = self.email
+        return result
+
 
 def _set_request_args(monkeypatch, module, args=None):
     monkeypatch.setattr(module, "request", SimpleNamespace(args=_Args(args or {})))