Password not saved when creating new source via POST API (works with PATCH)

## Bug Description

Password is not saved when creating a new data source via POST API, but works correctly when updating via PATCH API.

## Environment

- **Chronograf**: 1.10.7
- **InfluxDB**: 1.8.10(Enterprise)

## Steps to Reproduce

1. Create a new source with password:
```bash
curl -X POST 'http://localhost:8888/chronograf/v1/sources' \
-H 'Content-Type: application/json' \
-d '{
"name": "Test Source",
"type": "influx-enterprise",
"username": "admin",
"password": "admin",
"url": "http://192.168.213.72:8086",
"metaUrl": "http://192.168.2.181:8091/",
"telegraf": "telegraf"
}'
```

2. Check user permissions:
```bash
curl 'http://localhost:8888/chronograf/v1/sources/{id}/users'
```

**Expected**: Users should have permissions listed
**Actual**: All users show empty permissions: `"permissions": []`

## Workaround

Update password via PATCH after creation:
```bash
curl -X PATCH 'http://localhost:8888/chronograf/v1/sources/{id}' \
-H 'Content-Type: application/json' \
-d '{"password": "admin"}'
```

After PATCH, permissions load correctly.

## Impact

- Every new data source requires an additional PATCH request
- UI shows "Value saved in server" but password is not actually saved
- User permissions cannot be viewed until password is manually updated

## Root Cause Analysis

The password appears to be lost somewhere in the `NewSource` function flow in `server/sources.go`. The `UpdateSource` function works correctly because it explicitly checks and updates the password field:

```go
// UpdateSource - works correctly
if req.Password != "" {
src.Password = req.Password
}
```

However, in `NewSource`, the password is somehow not persisted to the database despite being present in the request.

Start in server/sources.go, reading the NewSource flow alongside UpdateSource's password handling. Reproduce the POST request from the issue, then check the source's users endpoint and compare the result with the PATCH workaround. Done means a password supplied during creation is persisted and user permissions load without a follow-up request.

Written by the indexing model from the issue text.