fix: reject passwords over bcrypt byte limit

[saurabhhhcodes]

Closes #932\n\nSummary:\n- reject passwords over bcrypt's 72-byte bcrypt limit in the shared password validator\n- keep registration and change-password paths on the shared validation path\n- add regressions for register and change-password using a UTF-8 password over 72 bytes\n\nValidation:\n- git diff --check\n- /Users/saurabhkumarbajpaiai/.cache/codex-runtimes/codex-primary-runtime/dependencies/python/bin/python3 -m pytest backend/tests/test_auth.py backend/tests/test_change_password.py -q

[saurabhhhcodes]

This is ready for review. If the repo uses GSSoC scoring labels, please apply the appropriate approval/level label when convenient. The fix is validated with targeted pytest runs for auth and change-password.