feat(auth): make password length configurable via env (min 5–30, max 30–128)

Add PASSWORD_MIN_LENGTH / PASSWORD_MAX_LENGTH (validated in src/env.ts) and a
shared passwordPolicy helper. The policy drives the zod schemas in register,
password reset and the admin create-user dialog, plus the live requirement
checks and strength meter in the register form.

Locale messages now interpolate the configured minimum via {min} instead of
hard-coding 12.

src/app/(site)/register/page.tsx

@@ -7,6 +7,7 @@ import {
 } from "@/components/auth/auth-landing";
 import { RegisterForm } from "@/components/auth/register-form";
 import { auth } from "@/lib/auth";
+import { passwordPolicy } from "@/lib/auth/password-policy";
 
 export async function generateMetadata(): Promise<Metadata> {
 	const t = await getTranslations("pages.register");
@@ -50,6 +51,8 @@ export default async function RegisterPage() {
 					hotelName={data.hotelName}
 					captcha={data.captcha}
 					nonce={data.nonce}
+					passwordMinLength={passwordPolicy.minLength}
+					passwordMaxLength={passwordPolicy.maxLength}
 				/>
 			}
 		/>

src/app/(site)/reset/page.tsx

@@ -3,6 +3,7 @@ import { getTranslations } from "next-intl/server";
 import { resetPassword } from "@/actions/password-reset";
 import Link from "@/components/link";
 import { ContentCard } from "@/components/public/ui";
+import { passwordPolicy } from "@/lib/auth/password-policy";
 
 export async function generateMetadata(): Promise<Metadata> {
 	const t = await getTranslations("pages.reset");
@@ -41,8 +42,12 @@ export default async function ResetPage({
 					<input
 						name="password"
 						type="password"
-						placeholder={t("passwordPlaceholder")}
+						placeholder={t("passwordPlaceholder", {
+							min: passwordPolicy.minLength,
+						})}
 						autoComplete="new-password"
+						minLength={passwordPolicy.minLength}
+						maxLength={passwordPolicy.maxLength}
 						required
 					/>
 					<button type="submit" className="btn btn-primary">
@@ -58,7 +63,7 @@ export default async function ResetPage({
 							marginBottom: 0,
 						}}
 					>
-						{t(errorKey)}
+						{t(errorKey, { min: passwordPolicy.minLength })}
 					</p>
 				) : null}
 				<p