Refuse passwords over 72 bytes and confirm only stored ones (closes #144)

bcrypt cannot hash a password longer than 72 bytes. PASS over the HTTP
API answered one with a 500, and the IRC listener confirmed it without
storing it.

Both transports now refuse a password outside 8 to 72 bytes with the
reply a short one already got: 461 over the HTTP API, a NOTICE over the
IRC listener. setPassword returns its error, and "Password set" is sent
only when the password was stored. A PASS given before registration is
checked after the welcome burst and gets the same NOTICE.

Model: opus-5-5

internal/handlers/api_test.go

@@ -2934,6 +2934,58 @@ func TestPassCommandShortPassword(t *testing.T) {
 	}
 }
 
+// maxPasswordBytes is the longest password bcrypt can hash.
+const maxPasswordBytes = 72
+
+// TestPassCommandLongPassword checks that a password over
+// maxPasswordBytes is refused like a short one, and that one
+// of exactly maxPasswordBytes is stored.
+func TestPassCommandLongPassword(t *testing.T) {
+	tserver := newTestServer(t)
+	token := tserver.createSession("longpw")
+
+	// Drain initial messages.
+	_, lastID := tserver.pollMessages(token, 0)
+
+	status, _ := tserver.sendCommand(
+		token,
+		map[string]any{
+			commandKey: irc.CmdPass,
+			bodyKey: []string{
+				strings.Repeat("a", maxPasswordBytes+1),
+			},
+		},
+	)
+	if status != http.StatusOK {
+		t.Fatalf("expected 200, got %d", status)
+	}
+
+	msgs, _ := tserver.pollMessages(token, lastID)
+
+	if !findNumeric(msgs, "461") {
+		t.Fatalf(
+			"expected ERR_NEEDMOREPARAMS (461), got %v",
+			msgs,
+		)
+	}
+
+	status, result := tserver.sendCommand(
+		token,
+		map[string]any{
+			commandKey: irc.CmdPass,
+			bodyKey: []string{
+				strings.Repeat("a", maxPasswordBytes),
+			},
+		},
+	)
+	if status != http.StatusOK || result[statusKey] != "ok" {
+		t.Fatalf(
+			"expected 200 and ok, got %d: %v",
+			status, result,
+		)
+	}
+}
+
 func TestPassCommandEmpty(t *testing.T) {
 	tserver := newTestServer(t)
 	token := tserver.createSession("emptypw")