Hashes the password using SHA-256 (replace with bcrypt if needed)
static String hash(String password) { final bytes = utf8.encode(password); final digest = sha256.convert(bytes); return digest.toString(); }