Credential disclosure via cleartext password logging

Sensitive-data exposure in sfturing hosp_order at commit 627f426 allows local users to read passwords and password-reset codes from logs. CommonUserServiceImpl.sign logs each registration password before hashing it, while the reset path logs each generated four-digit code; Logback writes both values to log.log and standard output. Exploitation requires access to application logs, aggregated output, backups, or support bundles and exposes reusable account credentials and active reset codes.