Implement password complexity validation for registration

[ArchILLtect]

• Enforce password rules: minimum length 8, at least 1 uppercase, 1 lowercase, and 1 digit.
• Map violations to 400 VALIDATION_ERROR with clear message.
• Add unit/integration tests for weak/valid password cases.
• Document rule in API docs.