feat(auth): make password length configurable via env (min 5–30, max 30–128)

Add PASSWORD_MIN_LENGTH / PASSWORD_MAX_LENGTH (validated in src/env.ts) and a
shared passwordPolicy helper. The policy drives the zod schemas in register,
password reset and the admin create-user dialog, plus the live requirement
checks and strength meter in the register form.

Locale messages now interpolate the configured minimum via {min} instead of
hard-coding 12.

src/lib/auth/password-policy.ts

@@ -0,0 +1,27 @@
+import { env } from "@/env";
+
+/** Hard floor/ceiling so a bad env value can never lock accounts out. */
+const ABSOLUTE_MIN_LENGTH = 5;
+const ABSOLUTE_MAX_LENGTH = 128;
+
+function toLength(value: unknown, fallback: number): number {
+	const parsed = typeof value === "number" ? value : Number(value);
+	return Number.isFinite(parsed) ? Math.trunc(parsed) : fallback;
+}
+
+/**
+ * Effective password-length policy. `PASSWORD_MIN_LENGTH` / `PASSWORD_MAX_LENGTH`
+ * drive the bounds; the values are clamped to a sane window so a typo in the env
+ * can neither accept empty passwords nor reject every possible one.
+ */
+export const passwordPolicy = (() => {
+	const minLength = Math.min(
+		ABSOLUTE_MAX_LENGTH,
+		Math.max(ABSOLUTE_MIN_LENGTH, toLength(env.PASSWORD_MIN_LENGTH, 12)),
+	);
+	const maxLength = Math.max(
+		minLength,
+		Math.min(ABSOLUTE_MAX_LENGTH, toLength(env.PASSWORD_MAX_LENGTH, 128)),
+	);
+	return { minLength, maxLength };
+})();