Fix getUserById to omit password and emailHash from response

[iamtanuj18]

Fixes #921.

GET /users/{userId} in application/backend/src/controllers/UsersController.ts was returning the raw bcrypt password hash and emailHash fields in the response body. Any authenticated OrganisationAdmin or StudyAdmin could retrieve any user's password hash by calling the endpoint with their user id.

PR #878 (Constrain User api response) fixed this class of bug for /users, /users/admin, and /users/admin/deleted by adding omit: { password: true, emailHash: true } to the Prisma queries. On this endpoint it updated the return type from User to UserResponse (= Omit<User, 'password' | 'emailHash'>) but the omit clause itself wasn't added to the findUnique call. So the declared response shape didn't match the runtime response.

Fix

Add omit: { password: true, emailHash: true } to the findUnique call in getUserById, matching the pattern the other three endpoints already use.

Test repair

The two omit-tests in the GET /users/:id describe block were not hitting the right endpoint. They called /users (list) instead of /users/{userId}, typed the body as GetAllUsersResponse, and asserted body.data[0]. So they passed regardless of what getUserById did, which is why #878's own CI didn't catch this leak.

Fixed to:

• Hit `/users/${userId}` using TestUsers.PARTICIPANT_UNANSWERED.id, the same fixture the neighbouring should return a user by ID test already uses.
• Type the body as GetUserByIdResponse and assert on body.data (single object, not array).

Verification

Swagger screenshot attached below.