feat: enforce maximum password length of 64 characters in user registration and password update

server/routes/admin.js

@@ -38,6 +38,9 @@ router.post('/users', authenticateToken, requireAdmin, async (req, res) => {
     if (password.length < 8) {
       return res.status(400).json({ error: 'Password must be at least 8 characters long' });
     }
+    if (password.length > 64) {
+      return res.status(400).json({ error: 'Password must not exceed 64 characters' });
+    }
 
     // M9: email format validation
     if (!EMAIL_RE.test(email)) {
@@ -160,6 +163,9 @@ router.put('/users/:id/password', authenticateToken, requireAdmin, async (req, r
     if (!newPassword || typeof newPassword !== 'string' || newPassword.length < 8) {
       return res.status(400).json({ error: 'Password must be at least 8 characters long' });
     }
+    if (newPassword.length > 64) {
+      return res.status(400).json({ error: 'Password must not exceed 64 characters' });
+    }
 
     const db = getDb();
     const hash = await bcrypt.hash(newPassword, 12);