fix: enforce shared new-password policy with stable error code

[sergey3bv]

Summary

• Applying unified password policy across register/reset/change/headless flows.

Avoid naming corporate partners, customers, or other sensitive external brands in this PR title or body. Use generic descriptors unless a maintainer explicitly approves the public reference.

Motivation

• A follow-up for feat: improve signup credential validation UX divine-mobile#3878

Related Issue

• Closes fix: enforce password policy for new passwords #203

Testing

• cargo test --workspace --verbose
• cargo clippy --workspace --all-targets --all-features -- -D warnings -A deprecated
• cargo fmt --all -- --check
• Manual verification completed

Visuals

• UI/web change with screenshots/video attached
• No visual change
• Visuals and text avoid sensitive external brand or partner names unless explicitly approved