Require a minimum password length of 12 characters for new passwords

Existing shorter passwords keep working and are still rehashed. The CLI
accepts shorter passwords in debug mode for development.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

max/auth/password_policy.py

@@ -1,13 +1,27 @@
-from .hashing import is_password_too_long
+from .hashing import MAX_PASSWORD_BYTES, is_password_too_long
 
+MIN_PASSWORD_LENGTH = 12
+
+PASSWORD_TOO_SHORT_MESSAGE = (
+    "The password must be at least {min_length} characters long"
+)
 PASSWORD_TOO_LONG_MESSAGE = (
-    "The password must be at most 72 bytes long "
-    "(72 characters, fewer with umlauts or special characters)"
+    "The password must be at most {max_bytes} bytes long "
+    "({max_bytes} characters, fewer with umlauts or special characters)"
+)
+# Fills the placeholders of the messages, e.g. t(error, **PASSWORD_MESSAGE_ARGUMENTS)
+PASSWORD_MESSAGE_ARGUMENTS = dict(
+    min_length=MIN_PASSWORD_LENGTH, max_bytes=MAX_PASSWORD_BYTES
 )
 
 
-def validate_password(password: str):
-    """Returns the (untranslated) error message, or None if the password is valid"""
+def validate_password(password: str, min_length=MIN_PASSWORD_LENGTH):
+    """
+    Checks a new password. Returns the (untranslated) error message, or None if the
+    password is valid. Existing passwords are not checked against this policy.
+    """
+    if len(password) < min_length:
+        return PASSWORD_TOO_SHORT_MESSAGE
     if is_password_too_long(password):
         return PASSWORD_TOO_LONG_MESSAGE
     return None