fix(settings): let admins relax the minimum password length to 1 (#543)

The password policy toggles (uppercase, lowercase, digit, special) can all be switched off in Settings -> Security, but the minimum-length input clamped at 4, so homelab admins couldn't deliberately allow short passwords. The API never enforced a floor; only the UI did. Lower the input floor to 1 and pin it with a test.

Closes #136

apps/web/src/components/settings/settings-dialog.tsx

@@ -1241,7 +1241,7 @@ export function AdminSecuritySettings() {
           onChange={(e) => updateSetting("passwordMinLength", e.target.value)}
           aria-label={t.settings.security.passwordMinLength}
           className="px-3 py-1.5 rounded-lg border border-border bg-background text-sm text-foreground w-24"
-          min={4}
+          min={1}
           max={128}
         />
       </SettingRow>

tests/unit/web/admin-security-settings-save-error.test.tsx

@@ -33,6 +33,14 @@ describe("AdminSecuritySettings save errors", () => {
     expect(message).toHaveClass("text-destructive");
   });
 
+  it("lets admins relax the minimum password length down to 1", async () => {
+    render(<AdminSecuritySettings />);
+    await waitFor(() => expect(apiGet).toHaveBeenCalled());
+
+    const input = screen.getByLabelText("Minimum Password Length");
+    expect(input).toHaveAttribute("min", "1");
+  });
+
   it("falls back to a generic message when the save rejects with a non-Error value", async () => {
     apiPut.mockRejectedValue("network exploded");