Subscription: support encrypted password auth in consumer builder

[VGalaxies]

Summary

• add encrypted password support to subscription consumer builders and runtime consumer metadata
• pass encrypted auth through subscription pipe creation, with fallback from encrypted verification to raw-password hashing
• add ignored integration coverage for encrypted-password pull consumer behavior and update related unit tests

Verification

• mvn -T 8 spotless:apply -P with-integration-tests
• mvn -T 8 clean package -P with-integration-tests -DskipUTs -pl integration-test,distribution -DfailIfNoTests=false -am -U

---

This PR was primarily authored with Codex using gpt-5.4 xhigh and then hand-reviewed by me. I AM responsible for every change made in this PR. I aimed to keep it aligned with our goals, though I may have missed minor issues. Please flag anything that feels off, I'll fix it quickly.