lemur: plaintext password storage on admin password update via API

When an admin updates a user's password via PUT /api/1/users/<id>, the password is stored as plaintext in the users.password column because the before_update listener is missing and service.update() does not call hash_password().

All Lemur deployments where admin users change passwords through the API endpoint PUT /api/1/users/<id>.

Apply the fix by adding a before_update listener or calling user.hash_password() in service.update(), then rotate any passwords that may have been stored in plaintext.