feat: add password

backend/src/backend/admin.py

@@ -9,6 +9,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from common.db.models import Roles, Users, WorkspaceMembers
 from common.ids import new_ulid
+from common.auth.passwords import hash_password
 from backend.dependencies import (
     RequestContext,
     database_session,
@@ -26,6 +27,7 @@ class EmployeeCreate(BaseModel):
     display_name: str = Field(min_length=1, max_length=100)
     email: str | None = Field(default=None, max_length=255)
     role_code: Literal["admin", "developer"] = "developer"
+    password: str = Field(min_length=8, max_length=72)
 
 
 class EmployeeUpdate(BaseModel):
@@ -133,7 +135,7 @@ async def create_employee(
         username=username,
         display_name=display_name,
         email=payload.email.strip() if payload.email else None,
-        password_hash="demo-login-disabled",
+        password_hash=hash_password(payload.password),
         status="active",
     )
     session.add(user)