fix(keys): new passwords have at least 12 characters

The register can't check a password it never sees, and should its
database leak, the verifier and the keys wrapped under the password fall
to guessing at Argon2id's cost (the second reading's M8). Devices now
refuse a new password shorter than 12 characters, counted as code points
once normalised (halkyon_keys' checkNewPassword), at sign-up, a reset
keeping the keys and a change alike, before anything is derived; the new
password's field says so, and the refusal has its own text (en, de).
Signing in takes any length, so a password set before keeps working.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_keys/test/password_text_test.dart

@@ -46,6 +46,53 @@ Future<void> main() async {
     });
   });
 
+  group('a new password', () {
+    Matcher refusedFor(PasswordRefusal reason) => throwsA(
+      isA<PasswordRefused>().having(
+        (refused) => refused.reason,
+        'reason',
+        reason,
+      ),
+    );
+
+    test('has at least 12 characters, counted once normalised, as code '
+        'points: the keys it wraps fall to guessing should the database '
+        'leak', () {
+      expect(newPasswordMinLength, 12);
+      expect(checkNewPassword('twelve chars'), 'twelve chars');
+      expect(
+        () => checkNewPassword('eleven char'),
+        refusedFor(PasswordRefusal.tooShort),
+      );
+      // Twelve emoji are twelve characters, though 24 UTF-16 units.
+      expect(checkNewPassword('🔑' * 12), '🔑' * 12);
+      expect(
+        () => checkNewPassword('🔑' * 11),
+        refusedFor(PasswordRefusal.tooShort),
+      );
+      // é typed as e and a combining accent counts once, as composed.
+      expect(
+        () => checkNewPassword('café au lai'),
+        refusedFor(PasswordRefusal.tooShort),
+      );
+      expect(checkNewPassword('café au lait'), 'café au lait');
+    });
+
+    test('is refused as any password is: empty, or with a control '
+        'character', () {
+      expect(() => checkNewPassword(''), refusedFor(PasswordRefusal.empty));
+      expect(
+        () => checkNewPassword('twelve	chars!'),
+        refusedFor(PasswordRefusal.controlCharacter),
+      );
+    });
+
+    test("an existing account's password of any length still unlocks: the "
+        'minimum holds only for new ones', () {
+      expect(normalizePassword('short'), 'short');
+    });
+  });
+
   test('the keys are made from the normalised password: typed either way, '
       'the same keys', () async {
     final sodium = await SodiumSumoInit.init();