Phase 4: Add password clearing in UserAPI controllers

Co-authored-by: devondragon <1254537+devondragon@users.noreply.github.com>

Author: Copilot

src/main/java/com/digitalsanctuary/spring/user/api/UserAPI.java

@@ -103,6 +103,11 @@ public ResponseEntity<JSONResponse> registerUserAccount(@Valid @RequestBody User
 			log.error("Unexpected error during registration.", ex);
 			logAuditEvent("Registration", "Failure", ex.getMessage(), null, request);
 			return buildErrorResponse("System Error!", 5, HttpStatus.INTERNAL_SERVER_ERROR);
+		} finally {
+			// Clear sensitive password data from memory
+			if (userDto != null) {
+				userDto.clearPasswords();
+			}
 		}
 	}
 
@@ -244,6 +249,11 @@ public ResponseEntity<JSONResponse> savePassword(@Valid @RequestBody SavePasswor
 			log.error("Unexpected error during password reset.", ex);
 			logAuditEvent("PasswordReset", "Failure", ex.getMessage(), null, request);
 			return buildErrorResponse("System Error!", 5, HttpStatus.INTERNAL_SERVER_ERROR);
+		} finally {
+			// Clear sensitive password data from memory
+			if (savePasswordDto != null) {
+				savePasswordDto.clearPasswords();
+			}
 		}
 	}
 
@@ -293,6 +303,11 @@ public ResponseEntity<JSONResponse> updatePassword(@AuthenticationPrincipal DSUs
 			log.error("Unexpected error during password update.", ex);
 			logAuditEvent("PasswordUpdate", "Failure", ex.getMessage(), user, request);
 			return buildErrorResponse("System Error!", 5, HttpStatus.INTERNAL_SERVER_ERROR);
+		} finally {
+			// Clear sensitive password data from memory
+			if (passwordDto != null) {
+				passwordDto.clearPasswords();
+			}
 		}
 	}