feat(auth): make session duration and password rules configurable

Replace the hardcoded 7-day session lifetime and fixed password
complexity rules with registry-backed accessors so they can be tuned
from the admin UI without a code change.

auth.go:
- Drop the SessionDuration const; keep DefaultSessionDuration (7 days)
  as the fallback used when no registry is wired (e.g. in tests).
- AuthHandler gains an optional *database.SettingsRegistry and a
  sessionDuration() helper that reads the registry, falling back to
  DefaultSessionDuration.
- Cookie MaxAge, JWT exp claim, and ExpiresIn responses now derive from
  sessionDuration() instead of the package-level SessionDurationSec, so
  a settings change takes effect on the next login.

refresh_token.go:
- Refresh-token lifetime follows sessionDuration() via a new
  refreshTokenTTL() helper (was a separate refreshTokenExpiration const
  that silently had to be kept in sync with the session duration).

password_validator.go:
- PasswordValidator now reads min length and the upper/lower/number/
  special toggles from the registry at validation time, so rule
  changes apply immediately. The special-character regex is compiled
  once and reused (sync.Once).
- GetPasswordRequirements() and ValidatePassword() reflect the active
  configured rules instead of a static list.
- Add SetDefaultPasswordSettings() so the package-level default
  validator (used by echo's struct-tag validator) follows live config.

All paths degrade gracefully to the historical defaults when no
registry is wired.

internal/handlers/refresh_token.go

@@ -14,10 +14,6 @@ import (
 	"github.com/labstack/echo/v5"
 )
 
-const (
-	refreshTokenExpiration = 7 * 24 * time.Hour // 7 days
-)
-
 type RefreshTokenRequest struct {
 	RefreshToken string `json:"refresh_token" validate:"required"`
 }
@@ -72,7 +68,7 @@ func (h *AuthHandler) RefreshAccessToken(c *echo.Context) error {
 	return c.JSON(http.StatusOK, RefreshTokenResponse{
 		AccessToken: accessToken,
 		TokenType:   "Bearer",
-		ExpiresIn:   SessionDurationSec,
+		ExpiresIn:   int(h.refreshTokenTTL().Seconds()),
 	})
 }
 
@@ -101,7 +97,7 @@ func (h *AuthHandler) CreateRefreshToken(userID uuid.UUID) (string, string, erro
 	tokenUUID := uuid.New()
 	refreshToken := tokenUUID.String()
 
-	expiresAt := time.Now().Add(refreshTokenExpiration)
+	expiresAt := time.Now().Add(h.refreshTokenTTL())
 	_, err := h.db.CreateRefreshToken(context.Background(), database.CreateRefreshTokenParams{
 		UserID:    pgtype.UUID{Bytes: userID, Valid: true},
 		Token:     pgtype.UUID{Bytes: tokenUUID, Valid: true},