fix(keys): new passwords have at least 12 characters

The register can't check a password it never sees, and should its
database leak, the verifier and the keys wrapped under the password fall
to guessing at Argon2id's cost (the second reading's M8). Devices now
refuse a new password shorter than 12 characters, counted as code points
once normalised (halkyon_keys' checkNewPassword), at sign-up, a reset
keeping the keys and a change alike, before anything is derived; the new
password's field says so, and the refusal has its own text (en, de).
Signing in takes any length, so a password set before keeps working.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_app/lib/l10n/halkyon_app_de.arb

@@ -206,5 +206,7 @@
   "passwordInstanceUnproven": "Die Instanz konnte nicht beweisen, dass sie dein Passwort kennt, daher vertraut dieses Gerät ihr nicht. Versuch es noch einmal; passiert es wieder, ist die Instanz nicht die, die sie zu sein behauptet.",
   "passwordKeysMissing": "Die Schlüssel deines Kontos sind nicht auf diesem Gerät. Melde dich hier ab und mit deinem Passwort wieder an.",
   "passwordUnsafeCosts": "Die Instanz wollte dein Passwort auf eine Weise prüfen lassen, die kein Konto nutzt, daher wurde nichts gesendet. Passiert es wieder, ist die Instanz nicht die, die sie zu sein behauptet.",
-  "passwordFailed": "Die Instanz war nicht erreichbar. Prüf die Verbindung und versuch es noch einmal."
+  "passwordFailed": "Die Instanz war nicht erreichbar. Prüf die Verbindung und versuch es noch einmal.",
+  "passwordMinLength": "Mindestens {count} Zeichen",
+  "passwordTooShort": "Ein neues Passwort braucht mindestens {count} Zeichen: Sollte die Datenbank der Instanz je nach außen gelangen, wird ein kurzes zuerst erraten."
 }

packages/halkyon_app/lib/l10n/halkyon_app_en.arb

@@ -432,5 +432,21 @@
   "passwordInstanceUnproven": "The instance couldn't prove it knows your password, so this device trusts nothing it says. Try again; if it happens again, the instance isn't the one it claims to be.",
   "passwordKeysMissing": "Your account's keys aren't on this device. Sign out and in again with your password here.",
   "passwordUnsafeCosts": "The instance asked for your password to be checked in a way no account uses, so nothing was sent. If it happens again, the instance isn't the one it claims to be.",
-  "passwordFailed": "Couldn't reach the instance. Check the connection and try again."
+  "passwordFailed": "Couldn't reach the instance. Check the connection and try again.",
+  "passwordMinLength": "At least {count} characters",
+  "@passwordMinLength": {
+    "placeholders": {
+      "count": {
+        "type": "int"
+      }
+    }
+  },
+  "passwordTooShort": "A new password needs at least {count} characters: should the instance's database ever leak, a short one is guessed first.",
+  "@passwordTooShort": {
+    "placeholders": {
+      "count": {
+        "type": "int"
+      }
+    }
+  }
 }

packages/halkyon_app/lib/l10n/halkyon_app_localizations.dart

@@ -1344,6 +1344,18 @@ abstract class HalkyonAppLocalizations {
   /// In en, this message translates to:
   /// **'Couldn\'t reach the instance. Check the connection and try again.'**
   String get passwordFailed;
+
+  /// No description provided for @passwordMinLength.
+  ///
+  /// In en, this message translates to:
+  /// **'At least {count} characters'**
+  String passwordMinLength(int count);
+
+  /// No description provided for @passwordTooShort.
+  ///
+  /// In en, this message translates to:
+  /// **'A new password needs at least {count} characters: should the instance\'s database ever leak, a short one is guessed first.'**
+  String passwordTooShort(int count);
 }
 
 class _HalkyonAppLocalizationsDelegate

packages/halkyon_app/lib/l10n/halkyon_app_localizations_de.dart

@@ -773,4 +773,14 @@ class HalkyonAppLocalizationsDe extends HalkyonAppLocalizations {
   @override
   String get passwordFailed =>
       'Die Instanz war nicht erreichbar. Prüf die Verbindung und versuch es noch einmal.';
+
+  @override
+  String passwordMinLength(int count) {
+    return 'Mindestens $count Zeichen';
+  }
+
+  @override
+  String passwordTooShort(int count) {
+    return 'Ein neues Passwort braucht mindestens $count Zeichen: Sollte die Datenbank der Instanz je nach außen gelangen, wird ein kurzes zuerst erraten.';
+  }
 }

packages/halkyon_app/lib/l10n/halkyon_app_localizations_en.dart

@@ -756,6 +756,16 @@ class HalkyonAppLocalizationsEn extends HalkyonAppLocalizations {
   @override
   String get passwordFailed =>
       'Couldn\'t reach the instance. Check the connection and try again.';
+
+  @override
+  String passwordMinLength(int count) {
+    return 'At least $count characters';
+  }
+
+  @override
+  String passwordTooShort(int count) {
+    return 'A new password needs at least $count characters: should the instance\'s database ever leak, a short one is guessed first.';
+  }
 }
 
 /// The translations for English, as used in the United Kingdom (`en_GB`).