security(users): SafeUser — passwordHash/токены не уходят клиенту

Шаг 0.8 плана production-готовности:
- shared/schema.ts: тип SafeUser + safeUserColumns
- getUsersByOrganization, listUsers, searchUsers, getUsersByRole,
  getUsersByOrgRoleId, documents getUser — без чувствительных колонок
- sync (initial/delta), автоматизации ctx.users.list, MCP list_users — sanitized

server/storage/tasks.storage.ts

@@ -1,4 +1,4 @@
-import { users, forms, tasks, taskMessages, messageReads, bots, roles, taskViews, type User, type Form, type FormTab, type FormField, type FormStatus, type StatusTransition, type Task, type TaskFieldValue, type TaskMessage, type TaskMessageWithAuthor, type MessageRead, type DataTableRow } from "@shared/schema";
+import { users, forms, tasks, taskMessages, messageReads, bots, roles, taskViews, type SafeUser, type Form, type FormTab, type FormField, type FormStatus, type StatusTransition, type Task, type TaskFieldValue, type TaskMessage, type TaskMessageWithAuthor, type MessageRead, type DataTableRow } from "@shared/schema";
 import { taskRelations } from "@shared/schema";
 import { taskAssignees, type TaskAssignee } from "@shared/schema";
 import { db } from "../db";
@@ -18,7 +18,7 @@ export class TasksStorage extends TasksCoreStorage {
     fieldValues: TaskFieldValue[];
     subtasks: Task[];
     messages: TaskMessageWithAuthor[];
-    users: User[];
+    users: Array<SafeUser & { fullName: string }>;
     hasRelations: boolean;
     assignees: Array<TaskAssignee & { user: { id: number; firstName: string | null; lastName: string | null; email: string } }>;
   } | null> {
@@ -53,7 +53,7 @@ export class TasksStorage extends TasksCoreStorage {
       this.getTaskAssignees(task.id, organizationId),
     ]);
 
-    const usersWithFullName = orgUsers.map((u: User) => ({
+    const usersWithFullName = orgUsers.map((u: SafeUser) => ({
       ...u,
       fullName: formatUserName(u)
     }));