fix(settings): let admins relax the minimum password length to 1 (#543)

The password policy toggles (uppercase, lowercase, digit, special) can all be switched off in Settings -> Security, but the minimum-length input clamped at 4, so homelab admins couldn't deliberately allow short passwords. The API never enforced a floor; only the UI did. Lower the input floor to 1 and pin it with a test.

Closes #136

tests/unit/web/admin-security-settings-save-error.test.tsx

@@ -33,6 +33,14 @@ describe("AdminSecuritySettings save errors", () => {
     expect(message).toHaveClass("text-destructive");
   });
 
+  it("lets admins relax the minimum password length down to 1", async () => {
+    render(<AdminSecuritySettings />);
+    await waitFor(() => expect(apiGet).toHaveBeenCalled());
+
+    const input = screen.getByLabelText("Minimum Password Length");
+    expect(input).toHaveAttribute("min", "1");
+  });
+
   it("falls back to a generic message when the save rejects with a non-Error value", async () => {
     apiPut.mockRejectedValue("network exploded");