security: align client password policy with server, enforce AUTH_SECRET length + entropy (#56)

Client-side validators (reset-password, invite-accept, first-admin setup,
user-create modal) previously checked password.length < 8 while every
server-side Zod schema required .min(12). External API consumers (or a
confused browser UI) could get past the client check but fail at the tRPC
boundary — or worse, quietly under-enforce policy compared to what
admins expect.

Fix: introduce PASSWORD_MIN_LENGTH (12) and PASSWORD_MAX_LENGTH (128) in
@capakraken/shared and import them from every pre-submit client validator
and every server Zod schema. Single source of truth; drift becomes a
compile error rather than a security finding.

Also hardens the AUTH_SECRET runtime check: in addition to the existing
placeholder-blacklist, production startup now rejects secrets shorter
than 32 chars OR with Shannon entropy below 3.5 bits/char. That covers
low-entropy-but-long values like "aaaa..." (38 chars, entropy 0) which
would have passed the previous checks.

Documented the rotation process for AUTH_SECRET + POSTGRES_PASSWORD in
docs/security-architecture.md §3.

Verified:
- pnpm test:unit — 396 files / 1922 tests passed
- pnpm --filter @capakraken/web exec tsc --noEmit — clean
- pnpm --filter @capakraken/api exec tsc --noEmit — clean

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

apps/web/src/components/admin/UserCreateModal.tsx

@@ -1,4 +1,4 @@
-import { SystemRole } from "@capakraken/shared";
+import { PASSWORD_MIN_LENGTH, SystemRole } from "@capakraken/shared";
 import { InfoTooltip } from "~/components/ui/InfoTooltip.js";
 
 const SYSTEM_ROLE_LABELS: Record<SystemRole, string> = {
@@ -129,7 +129,10 @@ export function UserCreateModal({
             type="button"
             onClick={onSubmit}
             disabled={
-              isPending || !state.name.trim() || !state.email.trim() || state.password.length < 8
+              isPending ||
+              !state.name.trim() ||
+              !state.email.trim() ||
+              state.password.length < PASSWORD_MIN_LENGTH
             }
             className="px-4 py-2 bg-brand-600 text-white rounded-lg hover:bg-brand-700 text-sm font-medium disabled:opacity-50 disabled:cursor-not-allowed"
           >