Fix: add min/max password length validation for auth

[DIPAK-555]

What

Added minimum and maximum length validation for passwords in the registration and reset password flows.

Why

Passwords previously had no upper bound, allowing extremely long values which could lead to performance issues and potential abuse.
This change aligns the validation with common industry security standards.

Changes

• Enforced minimum password length of 8 characters
• Enforced maximum password length of 32 characters
• Applied validation consistently to register and reset password endpoints
• Preserved existing password complexity rules (letters + numbers)

Testing

Manually tested using curl:

• valid password accepted
• short password rejected
• long password rejected
• missing number rejected
• missing letter rejected

Screenshots

Validation test outputs

Closes #302