Set password in settings.json is not as bad as you thought. Use this sequence:
- stop transmission.
- set password in settings file. Use
rpc-password
setting - start app and stop it again.
On last stop app should replace your password by hash. So maybe you dont need to do it dynamic.