fix(auth): guard the login + change-password verify paths against oversized passwords

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/tests/api_auth.rs

@@ -170,6 +170,26 @@ async fn login_rejects_wrong_password(pool: PgPool) {
     assert_eq!(body["error"]["code"], "unauthenticated");
 }
 
+#[sqlx::test(migrations = "./migrations")]
+async fn login_rejects_oversized_password_before_argon2(pool: PgPool) {
+    // A multi-KB password on the login path must be rejected as malformed
+    // input (400) rather than fed to argon2 — otherwise every attempt is a
+    // CPU-DoS. The account need not even exist; the guard is input-shape only.
+    let h = common::harness(pool);
+    let giant = "a".repeat(5000);
+    let resp = h
+        .app
+        .oneshot(common::post_json(
+            "/api/v1/auth/login",
+            json!({ "username": "alice", "password": giant }),
+        ))
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), StatusCode::BAD_REQUEST);
+    let body = common::body_json(resp).await;
+    assert_eq!(body["error"]["code"], "invalid_input");
+}
+
 #[sqlx::test(migrations = "./migrations")]
 async fn login_rejects_unknown_user(pool: PgPool) {
     let h = common::harness(pool);