feat(api): enforce password validation on reset and update flows

Add bcrypt_password validation to password reset and update endpoints:
- Add validation tag to PasswordReset.NewPassword struct field
- Add validation tag to UserPassword.NewPassword struct field
- Add c.Validate() calls in both handlers
- Fix off-by-one error in bcrypt_password validator (use <= 72 not < 72)

Password requirements: min 8 chars, max 72 bytes (bcrypt limit)

pkg/user/validator.go

@@ -54,7 +54,7 @@ func init() {
 			return false
 		}
 
-		return len([]byte(str)) < 72
+		return len([]byte(str)) <= 72
 	}
 
 	govalidator.TagMap["language"] = i18n.HasLanguage