fix(auth): new passwords need at least 8 characters (FLAW-09)

auth.ValidatePassword checks every way a password is set: setup,
registration, profile, admin create and reset, reset by mail. Same rule
in the browser before sending (lib/password.ts), with our own German
message instead of the browser popup. Existing shorter passwords still
log in. Profile and admin reset no longer trim the password, which made
passwords with surrounding spaces unusable for login.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/auth/auth_test.go

@@ -0,0 +1,22 @@
+package auth
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestValidatePassword(t *testing.T) {
+	cases := map[string]error{
+		"geheim12":              nil,
+		"äöüßäöüß":              nil, // counts characters, not bytes
+		"kurz":                  ErrPasswordTooShort,
+		"        ":              ErrPasswordTooShort,
+		strings.Repeat("a", 73): ErrPasswordTooLong,
+		"leer zeichen sind ok":  nil,
+	}
+	for pw, want := range cases {
+		if got := ValidatePassword(pw); got != want {
+			t.Errorf("ValidatePassword(%q) = %v, want %v", pw, got, want)
+		}
+	}
+}