Cap password length at 72 characters (DoS hardening)

[bernardhanna]

Summary

• Enforce a 72-character maximum password length server-side on registration, login, and password reset
• Add maxlength="72" on the shared password field component
• Add tests confirming oversized passwords are rejected and valid 72-character passwords still pass validation

Test plan

• php artisan test tests/Feature/Auth/PasswordLengthValidationTest.php
• After deploy: register with a normal password on https://codeweek.eu/register
• After deploy: confirm an oversized password returns a validation error
• Run npm run build on Forge so the frontend maxlength is live

Made with Cursor