Fix user creation and password policy (#48)

Root cause of "can't log in with new credentials": routes/user.js POST called
User.add, which doesn't exist on the redis User model (it has create) — so every
API-created account threw and was never persisted. Switch to User.create and make
the Add button a submit.

Replace the broken password rule (rejected strong "@123Caplowercase", accepted
weak "lowercase1") with a clear policy in utils/password_policy.js: >= 8 chars and
either 12+ chars or 3-of-4 character classes. Enforced server-side on create and
password changes, mirrored in public/lib/js/val.js, with unit tests.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

nodejs/views/users.ejs

@@ -82,14 +82,14 @@
 					</div>
 					<div class="form-group">
 						<label class="control-label">Password</label>
-						<input type="password" class="form-control" name="password" placeholder="Atleast 5 char. long" validate="password:5"/>
+						<input type="password" class="form-control" name="password" placeholder="8+ chars; mix upper/lower/number/symbol (or 12+)" validate="password"/>
 					</div>
 					<div class="form-group">
 						<label class="control-label">Again</label>
 						<input type="password" class="form-control" name="passwordMatch" placeholder="Retype password" validate="eq:password"/>
 					</div>
 					<hr />
-					<button type="button"  class="btn btn-info">
+					<button type="submit" class="btn btn-info">
 						Add
 					</button>
 				</form>