feat(auth): 口令强度策略（弱口令黑名单 / 账号派生值 / 长度上限）

背景（R61 实测）：浏览器密码管理器在「设置密码」页预填 123456，考生若直接提交，该口令即成为其账号真实口令；而后端此前仅由 validate 校验「长度 >= 6」，弱口令完全合法。R62 已从前端修掉预填，本次补齐后端这道闸门。

- app/lib/passwordPolicy.js + password_blacklist.json：口令策略唯一事实来源。黑名单刻意做成纯 JSON，供 Node 运行时与运维脚本共用，避免两份清单漂移。

- controller/auth.js：activate() 与 resetPassword() 接入策略（错误码 2001 / 7001），位置在 validate 之后、短信校验之前（纯本地计算、无副作用、快速失败）。

- validate/index.js：补 max:20，与前端 el-form 规则对齐（此前只有前端限制长度上限）。

- scripts/_db.cjs：DB 配置解析唯一入口；scan_weak_password_accounts.cjs：存量弱口令只读扫描器；verify_password_policy_api.cjs：真接口验证（含「强口令通过」正向对照臂，防假绿）。

app/lib/password_blacklist.json

@@ -0,0 +1,86 @@
+[
+  "123456",
+  "1234567",
+  "12345678",
+  "123456789",
+  "1234567890",
+  "654321",
+  "0987654321",
+  "111111",
+  "000000",
+  "222222",
+  "333333",
+  "444444",
+  "555555",
+  "666666",
+  "777777",
+  "888888",
+  "999999",
+  "123123",
+  "112233",
+  "121212",
+  "123321",
+  "159357",
+  "5201314",
+  "1314520",
+  "666888",
+  "168168",
+  "a123456",
+  "123456a",
+  "123456789a",
+  "password",
+  "passw0rd",
+  "password1",
+  "password123",
+  "p@ssw0rd",
+  "admin",
+  "admin123",
+  "admin888",
+  "administrator",
+  "root",
+  "root123",
+  "qwerty",
+  "qwertyuiop",
+  "qwerty123",
+  "abc123",
+  "abcd1234",
+  "abcabc",
+  "aa123456",
+  "iloveyou",
+  "letmein",
+  "welcome",
+  "monkey",
+  "dragon",
+  "master",
+  "sunshine",
+  "princess",
+  "football",
+  "baseball",
+  "superman",
+  "hello123",
+  "test123",
+  "test1234",
+  "zxcvbnm",
+  "asdfgh",
+  "asdfghjkl",
+  "qazwsx",
+  "1qaz2wsx",
+  "1qazxsw2",
+  "qwe123",
+  "qweasd",
+  "q1w2e3",
+  "pass123",
+  "p123456",
+  "123abc",
+  "abcd123",
+  "a1b2c3",
+  "beidou",
+  "beidouin",
+  "brskills",
+  "competition",
+  "competition123",
+  "contest",
+  "contest2026",
+  "hwasmart",
+  "hwasmart123"
+]