feat(auth): make password length configurable via env (min 5–30, max 30–128)

Add PASSWORD_MIN_LENGTH / PASSWORD_MAX_LENGTH (validated in src/env.ts) and a
shared passwordPolicy helper. The policy drives the zod schemas in register,
password reset and the admin create-user dialog, plus the live requirement
checks and strength meter in the register form.

Locale messages now interpolate the configured minimum via {min} instead of
hard-coding 12.

.env.example

@@ -64,6 +64,10 @@ AUTH_SECRET=your-super-secret-auth-key-change-this-min-32-chars
 APP_KEY=base64:your-app-key-here=
 # Bcrypt cost factor for new password hashes.
 BCRYPT_COST=12
+# Password-length policy for every new password (register, password reset and
+# staff-created accounts). Minimum: 5-30. Maximum: 30-128.
+PASSWORD_MIN_LENGTH=12
+PASSWORD_MAX_LENGTH=128
 
 # --- ANTI-DDOS (app-layer gate, production only) ---
 # On by default in production. Set to "false" to disable (not recommended).