[REFACTOR]:Shift password hashing and token generation inside the user model from controllers/auth_post.js

After the backend is complete shift the password hashing as a 'pre' save function on the user model .Also the jwt.sign method as a general method on the user model instead of having the code inside the controller.

Open `controllers/auth_post.js` first to find the current password hashing flow and `jwt.sign` call sites. Then inspect the user model file where the user schema is defined to move hashing into a pre-save hook and make token generation a model-level method. Done is when controller logic no longer signs tokens or hashes passwords directly and the user model owns both behaviors; verify via the project’s auth/login path or existing auth tests if available.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.