Handle password policy failures and authentication error codes

Password submissions now use shared configurable rules. Read passwordRules instead of assuming a fixed minimum length or character policy. Invalid submissions return INVALID_PASSWORD; a signup below the minimum length now returns HTTP 400 rather than 500.

Authentication can return PASSWORD_EXPIRED or ACCOUNT_LOCKED instead of a generic login failure. A password reset unlocks a locked account. Password-reset token failures now return HTTP 401. Update clients that branch on the previous error codes or status codes.