Fix SEC-05: add body size limit to REST API and max password length

- Wrap r.Body with http.MaxBytesReader (1 MiB) in decodeJSON so all
  REST API endpoints reject oversized JSON payloads
- Add MaxPasswordLen = 128 constant and enforce it in validate.Password()
  to prevent Argon2id DoS via multi-MB passwords
- Add test for oversized JSON body rejection (>1 MiB -> 400)
- Add test for password max length enforcement

Security: decodeJSON now applies the same body size limit the UI layer
already uses, closing the asymmetry. MaxPasswordLen caps Argon2id input
to a reasonable length, preventing CPU-exhaustion attacks.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/validate/validate_test.go

@@ -32,6 +32,17 @@ func TestPasswordTooShort(t *testing.T) {
 	}
 }
 
+func TestPasswordTooLong(t *testing.T) {
+	// Exactly MaxPasswordLen should be accepted.
+	if err := Password(strings.Repeat("a", MaxPasswordLen)); err != nil {
+		t.Errorf("Password(len=%d) = %v, want nil", MaxPasswordLen, err)
+	}
+	// One over the limit should be rejected.
+	if err := Password(strings.Repeat("a", MaxPasswordLen+1)); err == nil {
+		t.Errorf("Password(len=%d) = nil, want error", MaxPasswordLen+1)
+	}
+}
+
 func TestUsernameValid(t *testing.T) {
 	valid := []string{
 		"alice",