security(users): SafeUser — passwordHash/токены не уходят клиенту

Шаг 0.8 плана production-готовности:
- shared/schema.ts: тип SafeUser + safeUserColumns
- getUsersByOrganization, listUsers, searchUsers, getUsersByRole,
  getUsersByOrgRoleId, documents getUser — без чувствительных колонок
- sync (initial/delta), автоматизации ctx.users.list, MCP list_users — sanitized

server/services/ai-bot.service.ts

@@ -10,7 +10,7 @@ import { McpClient } from '../utils/mcp-client';
 import { eventBus } from '../routes/shared';
 import { publishConvTypingEvent } from '../routes/messenger.helpers';
 import { getOllamaNumThread, getOllamaNumCtx } from '../utils/ollama-config';
-import type { Bot, Task, User } from '@shared/schema';
+import type { Bot, Task, SafeUser } from '@shared/schema';
 import { db } from '../db';
 import { conversationMessages, bots } from '@shared/schema';
 import { eq, and, desc } from 'drizzle-orm';
@@ -48,7 +48,7 @@ interface AiBotContext {
   task: Task;
   message: string;
   attachments?: Array<{ url: string; name: string; size: number; mimeType?: string }>;
-  user: User;
+  user: SafeUser;
   organizationId: number;
 }
 
@@ -189,7 +189,7 @@ async function callLlm(
   }
 }
 
-export function checkBotAccess(bot: Bot, user: User): boolean {
+export function checkBotAccess(bot: Bot, user: SafeUser): boolean {
   const policy = bot.accessPolicy;
   if (!policy || policy.mode === 'all') return true;
   if (policy.mode === 'roles') {
@@ -491,7 +491,7 @@ export async function handleAiBotDirectMessage(ctx: {
   bot: Bot;
   conversationId: number;
   message: string;
-  user: User;
+  user: SafeUser;
   organizationId: number;
 }): Promise<void> {
   const { bot, conversationId, message, user, organizationId } = ctx;

server/services/task-message.service.ts

@@ -1,5 +1,5 @@
 import { storage } from "../storage";
-import type { NotificationEvent, Bot, Task, User, TaskMessage } from "@shared/schema";
+import type { NotificationEvent, Bot, Task, SafeUser, TaskMessage } from "@shared/schema";
 import { notificationService, EVENT_TYPES } from "./notification.service";
 import { webhookService } from "./webhook.service";
 import { generateBotServiceToken } from "../utils/jwt";
@@ -23,7 +23,7 @@ type MessageAttachment = { url: string; name: string; size: number; mimeType?: s
 
 export interface SendTaskMessageParams {
   task: Task;                      // задача (уже загружена и проверена вызывающим кодом)
-  user?: User;                     // автор сообщения; необязателен, если передан botId
+  user?: SafeUser;                 // автор сообщения; необязателен, если передан botId
   botId?: number | null;           // сообщение от бота: authorId=null, botId, messageType='bot'
   organizationId: number;
   message: string;