feat(auth): data-driven password requirement checkers

GET /api/auth/password-rules (public, pre-auth) exposes the ACTIVE
complexity config from the settings registry; password_validation.ts
now fetches it and generates the checklist rows per active rule —
inactive requirements no longer linger as fake tasks, and the min
length mirrors the admin's setting instead of a hardcoded 8.

Surfaces: register, setup, admin create-user (Users page), profile
password change (self + admin variants, now gated on checklist pass;
misleading minlength=6 dropped — the server was always the enforcer).

Verified live: flip min_length=12 / number+special off via the
settings API → endpoint + register/profile/admin checklists re-render
row-for-row; enforcement follows (short rejected, rule-valid accepted
without digits/specials); restore defaults → checklists return.

web/src/setup.ts

@@ -11,7 +11,7 @@ import {
   handleError,
 } from "./api";
 import { showToast } from "./toast";
-import { initPasswordValidation } from "./password_validation";
+import { initPasswordValidation, loadPasswordRules } from "./password_validation";
 
 interface LibraryEntry {
   id: string;
@@ -71,9 +71,7 @@ function initSetup(): void {
   init() {
     initSetup();
     this.admin.baseUrl = window.location.origin;
-    setTimeout(() => {
-      initPasswordValidation();
-    }, 100);
+    loadPasswordRules().then(() => initPasswordValidation());
 
     const modal = document.getElementById("folder-browser-modal");
     if (modal) {