fix(dex): store raw bcrypt hash in Password CR, not base64-encoded

The original NOTE claimed Dex's kubernetes storage types Hash as []byte,
requiring the bcrypt string to be base64-encoded before storage. This was
wrong: Dex v2.41 stores and compares the hash field as a plain string. The
base64-encoding caused every invite login to fail with 'Invalid credentials'
because Dex passed the base64 bytes (starting with 'J' not '$') directly to
bcrypt. Static passwords in the configmap always used raw bcrypt strings and
worked fine — confirming the dynamic CR encoding was the bug.

internal/adapters/dex/dex_test.go

@@ -2,7 +2,6 @@ package dex
 
 import (
 	"context"
-	"encoding/base64"
 	"encoding/json"
 	"io"
 	"net/http"
@@ -46,10 +45,8 @@ func TestCreatePasswordSuccess(t *testing.T) {
 	require.Equal(t, "new-dot-user-at-example-dot-com", gotBody.Metadata["name"])
 	require.Equal(t, "auth", gotBody.Metadata["namespace"])
 
-	// The hash is the BASE64 of the bcrypt string (Dex stores hash as []byte).
-	decoded, err := base64.StdEncoding.DecodeString(gotBody.Hash)
-	require.NoError(t, err)
-	require.Equal(t, "$2a$12$abcdefghijklmnopqrstuv", string(decoded))
+	// Hash is stored as the raw bcrypt string — Dex compares it directly.
+	require.Equal(t, "$2a$12$abcdefghijklmnopqrstuv", gotBody.Hash)
 }
 
 func TestCreatePasswordConflict(t *testing.T) {