fix(security): raise password minimum to 12 chars, hide raw error messages, add audit script

- Password validation: min(8) → min(12) across auth.ts, user-procedure-support.ts,
  and invite.ts (aligns with NIST SP 800-63B modern recommendations)
- Error boundary: stop rendering raw error.message which could leak internal
  details; always show the generic fallback text
- Add `pnpm audit` script (--audit-level=high) for dependency vulnerability scanning

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

package.json

@@ -13,6 +13,7 @@
     "test:e2e": "node ./scripts/run-from-workspace-root.mjs turbo test:e2e",
     "test:e2e:email": "pnpm --filter @capakraken/web test:e2e:email",
     "test:scripts": "node --test scripts/*.test.mjs",
+    "audit": "pnpm audit --audit-level=high",
     "check:architecture": "node ./scripts/check-architecture-guardrails.mjs",
     "check:exports": "node ./scripts/check-workspace-exports.mjs",
     "check:imports": "node ./scripts/check-workspace-imports.mjs",