security: reject common/weak passwords on every set-password path (#31)

Adds a synchronous policy check that blocks (1) the curated >=12-char
common-password list (rockyou top, predictable seasonal, admin defaults),
(2) trivial patterns (single-char repeat, short-pattern repeat, keyboard
or numeric sequences), and (3) passwords containing the user's email
local-part or any name component. Wired into all five password-mutation
sites: first-admin setup, admin createUser/setUserPassword, invite
acceptance, and password-reset.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

packages/application/src/__tests__/read-workbook.test.ts

@@ -137,7 +137,7 @@ describe("readWorksheetMatrix", () => {
     await expect(readWorksheetMatrix(workbookPath, "Sheet1")).rejects.toThrow(
       `exceeds the ${MAX_DISPO_WORKBOOK_ROWS} row import limit`,
     );
-  }, 60000);
+  }, 30000);
 
   it("rejects worksheets that exceed the column limit", async () => {
     const directory = await makeTempDirectory();
@@ -149,7 +149,7 @@ describe("readWorksheetMatrix", () => {
     await expect(readWorksheetMatrix(workbookPath, "Sheet1")).rejects.toThrow(
       `exceeds the ${MAX_DISPO_WORKBOOK_COLUMNS} column import limit`,
     );
-  }, 60000);
+  }, 30000);
 
   describe("DISPO_IMPORT_DIR allowlist", () => {
     it("rejects absolute paths that escape the configured import dir", async () => {