As long as you’re using TLS, passwords are sent encrypted. If you’re not using TLS, you’re on a fast train to doom regardless.
If you meant “hashed” rather than “encrypted”, then no, that is not a supported configuration, because the hashing mechanism used within Discourse is not a part of the public interface contract, and is subject to change at any time.
Well, yes, but if someone’s got access to your laptop, they can just drop a keylogger that captures the password before it goes through any hashing process. The security threat model of Discourse (and every single web application) includes the stipulation that the endpoint is not compromised.