Add password setup flow with server-side validation

- Replace external password setup link with internal navigation
- Add comprehensive password validation utility with strength requirements
- Create dedicated password setup page and API endpoint
- Streamline user flow from email verification to password creation

server/utils/security.ts

@@ -128,6 +128,59 @@ export const cleanupOldEntries = (): void => {
   console.log('🧹 Cleaned up old security entries');
 };
 
+// Password validation function
+export const validatePassword = (password: string): { isValid: boolean; errors: string[] } => {
+  const errors: string[] = [];
+  
+  if (!password || typeof password !== 'string') {
+    errors.push('Password is required');
+    return { isValid: false, errors };
+  }
+
+  if (password.length < 8) {
+    errors.push('Password must be at least 8 characters long');
+  }
+
+  if (password.length > 128) {
+    errors.push('Password must not exceed 128 characters');
+  }
+
+  if (!/[A-Z]/.test(password)) {
+    errors.push('Password must contain at least one uppercase letter');
+  }
+
+  if (!/[a-z]/.test(password)) {
+    errors.push('Password must contain at least one lowercase letter');
+  }
+
+  if (!/[0-9]/.test(password)) {
+    errors.push('Password must contain at least one number');
+  }
+
+  // Optional: require special characters
+  // if (!/[^A-Za-z0-9]/.test(password)) {
+  //   errors.push('Password must contain at least one special character');
+  // }
+
+  // Check for common weak patterns
+  const commonPatterns = [
+    /(.)\1{2,}/i, // Three or more consecutive identical characters
+    /123456|654321|abcdef|qwerty|password|admin|login/i, // Common weak passwords
+  ];
+
+  for (const pattern of commonPatterns) {
+    if (pattern.test(password)) {
+      errors.push('Password contains common patterns that make it weak');
+      break;
+    }
+  }
+
+  return {
+    isValid: errors.length === 0,
+    errors
+  };
+};
+
 // Initialize cleanup interval (runs every 5 minutes)
 if (typeof setInterval !== 'undefined') {
   setInterval(cleanupOldEntries, 5 * 60 * 1000);