feat(auth): #66: replace regex password strength with entropy-based validation

[imdeepmind]

Closes #66

Summary

Replaces the hand-rolled regex-based password_strength validation with the go-password-validator library, which scores passwords by Shannon entropy instead of checking a fixed set of character classes.

Changes

• internal/features/auth/service.go — added minPasswordEntropy = 60.0 named constant; validatePasswordStrength now calls passwordvalidator.Validate(password, minPasswordEntropy). The four regexp.MustCompile class-counting checks are gone.
• internal/shared/errors/errors.go — added ErrWeakPassword sentinel so a weak password surfaces a clear, actionable message instead of the generic "incomplete or invalid" error.
• internal/features/auth/service.go — Register/ResetPassword return ErrWeakPassword when the password_strength rule fails, ErrInvalidInput otherwise (via passwordValidationError).
• frontend/src/lib/validations.ts — dropped the client-side class-counting regex checks (uppercase/lowercase/number/symbol) from the password schemas; kept min 8. Strength is now backend-owned.
• go.mod/go.sum — added github.com/wagslane/go-password-validator v0.3.0.

Behavior

• Long strong passphrases (e.g. correcthorsebatterystaple, ~117 bits) are accepted.
• Short/weak passwords (e.g. password, ~37 bits) are rejected with a clear message.
• min=8 and the password_strength validator glue are unchanged; the Wails-bound surface is untouched (no wailsjs regeneration needed).

Verification

• go build ./..., go vet ./..., gofmt clean
• npm --prefix frontend run lint, npm --prefix frontend run type-check