chore(auth): allow six-byte internal passwords

backend-api/internal/domain/auth.go

@@ -17,7 +17,7 @@ const (
 	MaxUsernameBytes   = 128
 	MaxDeviceNameBytes = 128
 	MaxVersionBytes    = 128
-	MinPasswordBytes   = 12
+	MinPasswordBytes   = 6
 	MaxPasswordBytes   = 72
 )
 

backend-api/internal/platform/password/bcrypt_test.go

@@ -40,12 +40,15 @@ func TestBcryptRejectsInvalidCostAndOversizedPasswords(t *testing.T) {
 		t.Fatalf("NewBcrypt() error = %v", err)
 	}
 	oversized := strings.Repeat("x", 73)
-	if _, err := manager.Hash("too-short"); !errors.Is(
+	if _, err := manager.Hash("short"); !errors.Is(
 		err,
 		ErrInvalidPassword,
 	) {
 		t.Fatalf("Hash(short) error = %v", err)
 	}
+	if _, err := manager.Hash("sixsix"); err != nil {
+		t.Fatalf("Hash(six-byte password) error = %v", err)
+	}
 	if _, err := manager.Hash(oversized); !errors.Is(
 		err,
 		ErrInvalidPassword,