feat(auth): make password length configurable via env (min 5–30, max 30–128)

Add PASSWORD_MIN_LENGTH / PASSWORD_MAX_LENGTH (validated in src/env.ts) and a
shared passwordPolicy helper. The policy drives the zod schemas in register,
password reset and the admin create-user dialog, plus the live requirement
checks and strength meter in the register form.

Locale messages now interpolate the configured minimum via {min} instead of
hard-coding 12.

src/lib/validators/user.ts

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { passwordPolicy } from "@/lib/auth/password-policy";
 
 export const createUserSchema = z.object({
 	username: z
@@ -10,7 +11,16 @@ export const createUserSchema = z.object({
 			"Username can only contain letters, numbers, _ and -",
 		),
 	mail: z.string().email("Invalid email address"),
-	password: z.string().min(6, "Password must be at least 6 characters"),
+	password: z
+		.string()
+		.min(
+			passwordPolicy.minLength,
+			`Password must be at least ${passwordPolicy.minLength} characters`,
+		)
+		.max(
+			passwordPolicy.maxLength,
+			`Password must be at most ${passwordPolicy.maxLength} characters`,
+		),
 	rank: z.coerce.number().int().min(1).max(7).default(1),
 	motto: z.string().max(127).default(""),
 });