[VULN-19] No Password Strength Requirements

[lyncmi07]

Severity: Medium
Affected location: routes/auth.ts:19-20

Issue:
Passwords are only checked for non-empty value; weak passwords are allowed.

Mitigation plan:

1. Enforce minimum length (e.g., 8+).
2. Optionally add breached-password checks and complexity guidance.
3. Return clear validation errors to users.

Verification / tests:

• Unit tests for password policy acceptance/rejection cases.
• Signup integration tests for invalid weak passwords.