[Security] Enforce a consistent minimum password policy

[mindsers]

Summary

Password policy is inconsistent across flows. Setup accepts min(1); the profile change-password action applies no schema validation (an empty password is possible); register/reset enforce min(8).

Affected code

• app/features/authentication/routes/profile.tsx (~L256-263, no schema validation)
• Setup password schema (min(1))

Remediation

Unify on ≥ 8 characters everywhere (ideally add a breached-password / zxcvbn strength check).

Severity

Low.

---

Source: internal security review (commit 0360e87, 2026-07-21).