feat(auth): make password length configurable via env (min 5–30, max 30–128)

Add PASSWORD_MIN_LENGTH / PASSWORD_MAX_LENGTH (validated in src/env.ts) and a
shared passwordPolicy helper. The policy drives the zod schemas in register,
password reset and the admin create-user dialog, plus the live requirement
checks and strength meter in the register form.

Locale messages now interpolate the configured minimum via {min} instead of
hard-coding 12.

src/messages/en.json

@@ -1058,7 +1058,7 @@
 			"confirmPassword": "Repeat password",
 			"usernamePlaceholder": "Username",
 			"emailPlaceholder": "Email",
-			"passwordPlaceholder": "Password (min 12 chars)",
+			"passwordPlaceholder": "Password (min {min} chars)",
 			"confirmPasswordPlaceholder": "Repeat password",
 			"selectOutfit": "Select your outfit",
 			"termsAccept": "I am 18+ and accept the {hotel} terms & rules.",
@@ -1081,7 +1081,7 @@
 			"termsError": "You must accept the terms & rules to register.",
 			"usernameError": "Username is required.",
 			"emailError": "Valid email is required.",
-			"passwordError": "Password must be at least 12 characters",
+			"passwordError": "Password must be at least {min} characters",
 			"confirmPasswordError": "Passwords do not match.",
 			"termsRequired": "You must accept the terms & rules.",
 			"usernameRequired": "Username is required.",
@@ -1093,7 +1093,7 @@
 			"strengthFair": "Fair",
 			"strengthGood": "Good",
 			"strengthStrong": "Strong",
-			"passwordMinLength": "Password must be at least 12 characters",
+			"passwordMinLength": "Password must be at least {min} characters",
 			"passwordUpper": "Password must contain at least one uppercase letter",
 			"passwordLower": "Password must contain at least one lowercase letter",
 			"passwordDigit": "Password must contain at least one digit",
@@ -1128,10 +1128,10 @@
 		"reset": {
 			"title": "Set a new password",
 			"subtitle": "Choose a strong password you don't use elsewhere.",
-			"passwordPlaceholder": "New password (min 12 chars)",
+			"passwordPlaceholder": "New password (min {min} chars)",
 			"resetPassword": "Reset password",
 			"backToLogin": "Back to login",
-			"passwordMinLength": "Password must be at least 12 characters",
+			"passwordMinLength": "Password must be at least {min} characters",
 			"tooManyAttempts": "Too many attempts — try again later",
 			"invalidLink": "This reset link is invalid or has expired. Request a new one.",
 			"failed": "The password could not be reset. Please try again."