update getting started

[pxpm]

WHY

BEFORE - What was wrong? What was happening before this PR?

Reported in #5429 the instructions would double hash the password for installations that came with the password already casted in the model, like by default Laravel 11:

/**
     * Get the attributes that should be cast.
     *
     * @return array<string, string>
     */
    protected function casts(): array
    {
        return [
            'email_verified_at' => 'datetime',
            'password' => 'hashed',
        ];
    }

AFTER - What is happening after this PR?

I updated the docs to be clear when developers should or not cast the password with the model events.