feat(auth): 12-character minimum, 72-byte maximum and breach check for new passwords

- New passwords (create user, admin reset, own change) need at least 12
  characters (ASVS 2.1.1) and may not exceed 72 bytes, which bcrypt would
  silently cut off.
- They are checked against Have I Been Pwned with k-anonymity (only the
  first 5 SHA-1 characters leave the server, padded responses); an
  unreachable service is logged and does not block. PASSWORD_BREACH_CHECK
  =false disables it for offline deployments.
- Login accepts existing passwords as before, capped at 256 characters to
  bound anonymous bcrypt work.
- Password fields in the UI say the rule up front.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Frontend/src/app/(app)/profile/page.tsx

@@ -258,11 +258,15 @@ function PasswordSection() {
               id="new-password"
               type="password"
               autoComplete="new-password"
-              minLength={8}
+              minLength={12}
+              aria-describedby="new-password-rule"
               required
               value={newPassword}
               onChange={(event) => setNewPassword(event.target.value)}
             />
+            <p id="new-password-rule" className="text-xs text-muted-foreground">
+              Mindestens 12 Zeichen. Passwörter aus bekannten Datenlecks werden abgelehnt.
+            </p>
           </div>
           {error ? (
             <p role="alert" className="text-sm text-destructive">

ApiCore-Frontend/src/app/(app)/settings/users-roles/create-user-dialog.tsx

@@ -94,11 +94,15 @@ export function CreateUserDialog() {
             <Input
               id="new-user-password"
               type="password"
-              minLength={8}
+              minLength={12}
+              aria-describedby="new-user-password-rule"
               required
               value={password}
               onChange={(event) => setPassword(event.target.value)}
             />
+            <p id="new-user-password-rule" className="text-xs text-muted-foreground">
+              Mindestens 12 Zeichen. Passwörter aus bekannten Datenlecks werden abgelehnt.
+            </p>
           </div>
           <div className="flex flex-col gap-2">
             <Label htmlFor="new-user-role">Rolle</Label>

ApiCore-Frontend/src/app/(app)/settings/users-roles/edit-user-dialog.tsx

@@ -122,11 +122,15 @@ function EditUserForm({ user, onSaved }: { user: User; onSaved: () => void }) {
           id="edit-user-password"
           type="password"
           autoComplete="new-password"
-          minLength={8}
+          minLength={12}
+          aria-describedby="edit-user-password-rule"
           placeholder="Leer lassen, um es nicht zu ändern"
           value={newPassword}
           onChange={(event) => setNewPassword(event.target.value)}
         />
+        <p id="edit-user-password-rule" className="text-xs text-muted-foreground">
+          Mindestens 12 Zeichen. Passwörter aus bekannten Datenlecks werden abgelehnt.
+        </p>
         <p className="text-xs text-muted-foreground">
           Setzt das Passwort neu und meldet den Benutzer auf allen Geräten ab.
           Das eigene Passwort wird stattdessen im eigenen Profil geändert.