Register requires 8-72 printable ASCII characters; login only caps the
password at 72 bytes and no longer enforces a minimum, so accounts created
under the previous policy can still sign in.
OpenAPI snapshot is delivered from backend and schema.d.ts regenerated with
npm run openapi:generate (CredentialsDto is now RegisterDto and LoginDto).
ksv741