feat(auth): make password length configurable via env (min 5–30, max 30–128)

Add PASSWORD_MIN_LENGTH / PASSWORD_MAX_LENGTH (validated in src/env.ts) and a
shared passwordPolicy helper. The policy drives the zod schemas in register,
password reset and the admin create-user dialog, plus the live requirement
checks and strength meter in the register form.

Locale messages now interpolate the configured minimum via {min} instead of
hard-coding 12.

src/lib/validators/user.test.ts

@@ -12,7 +12,7 @@ describe("createUserSchema", () => {
 		const result = createUserSchema.safeParse({
 			username: "TestUser",
 			mail: "[email protected]",
-			password: "secret123",
+			password: "secret123456",
 		});
 		expect(result.success).toBe(true);
 		if (result.success) {
@@ -26,7 +26,7 @@ describe("createUserSchema", () => {
 			createUserSchema.safeParse({
 				username: "ab",
 				mail: "[email protected]",
-				password: "secret123",
+				password: "secret123456",
 			}).success,
 		).toBe(false);
 	});
@@ -36,7 +36,7 @@ describe("createUserSchema", () => {
 			createUserSchema.safeParse({
 				username: "a".repeat(21),
 				mail: "[email protected]",
-				password: "secret123",
+				password: "secret123456",
 			}).success,
 		).toBe(false);
 	});
@@ -46,7 +46,7 @@ describe("createUserSchema", () => {
 			createUserSchema.safeParse({
 				username: "user@name",
 				mail: "[email protected]",
-				password: "secret123",
+				password: "secret123456",
 			}).success,
 		).toBe(false);
 	});
@@ -56,7 +56,7 @@ describe("createUserSchema", () => {
 			createUserSchema.safeParse({
 				username: "TestUser",
 				mail: "not-an-email",
-				password: "secret123",
+				password: "secret123456",
 			}).success,
 		).toBe(false);
 	});