feat(auth): make password length configurable via env (min 5–30, max 30–128)

Add PASSWORD_MIN_LENGTH / PASSWORD_MAX_LENGTH (validated in src/env.ts) and a
shared passwordPolicy helper. The policy drives the zod schemas in register,
password reset and the admin create-user dialog, plus the live requirement
checks and strength meter in the register form.

Locale messages now interpolate the configured minimum via {min} instead of
hard-coding 12.

src/components/auth/auth-field.tsx

@@ -28,6 +28,8 @@ export interface AuthFieldProps {
 		| "search";
 	required?: boolean;
 	disabled?: boolean;
+	minLength?: number;
+	maxLength?: number;
 	/** Marks the field with `aria-invalid` and a danger border. */
 	invalid?: boolean;
 	/** id of the element describing this field (e.g. an error banner). */
@@ -61,6 +63,8 @@ export function AuthField({
 	inputMode,
 	required,
 	disabled,
+	minLength,
+	maxLength,
 	invalid,
 	describedBy,
 	iconColor = "var(--color-text-muted)",
@@ -93,6 +97,8 @@ export function AuthField({
 					inputMode={inputMode}
 					required={required}
 					disabled={disabled}
+					minLength={minLength}
+					maxLength={maxLength}
 					aria-invalid={invalid ? true : undefined}
 					aria-describedby={describedBy}
 					className={`auth-input has-icon ${trailing ? "has-action" : ""}`}