docs(auth0): add sensitive-data handling cautions to migration and CLI references (#149)

Warn that user export files contain password hashes/PII (don't commit,
keep out of CI logs, delete after import) and that --json user command
output/import payloads expose profiles and password hashes.

Author: frederikprijck

plugins/auth0/skills/auth0/references/feature-migration.md

@@ -953,6 +953,8 @@ Detailed guide for exporting users from existing auth providers and importing th
 
 ## Exporting Users from Common Providers
 
+**Caution:** These export files contain password hashes and PII. Never commit them (add to `.gitignore`), keep them out of shared/CI logs, and delete them once the import succeeds.
+
 ### Firebase
 
 **Via Firebase Console:**

plugins/auth0/skills/auth0/references/tooling-cli.md

@@ -98,6 +98,8 @@ auth0 users import --connection-name "Username-Password-Authentication" \
   --users '[...]' --upsert --json
 ```
 
+**Note:** `--json` output for user commands returns full profiles (email, metadata) and import payloads carry password hashes — avoid piping to shared logs/CI output.
+
 ### Roles — Manage RBAC Roles
 
 Create roles, assign permissions, and assign roles to users.