More complete Password Policy and Expiry

## UI Changes
* Instead of "Basic Policies" and "Advanced Policies", change the two pane to "Recommended Policies" and "Other Policies". Change the description on top to "If your app is using Password as a primary authenticator, we recommend setting Password Strength and Minimum Password length to ensure your users are using a strong enough password (hopefully with a Password Manager); Other password policies are usually less effective and you should probably use them if it is required by your organization's security policy."
* In "Recommended Policies", put "Password Strength Level" and "Minimum Password Length" there.
* Put all other options in "Other Policies"

## Make default compliance to [ASVS](https://github.com/OWASP/ASVS)
- [ ] Maximum password length; default=128 ([OWASP cheatsheet recommend 64](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#implement-proper-password-strength-controls), [ASVS 2.1.2 say 128](https://github.com/OWASP/ASVS/blob/master/4.0/en/0x11-V2-Authentication.md#v21-password-security-requirements))
- [ ] Set Min. Password Strength Level = Fair (ASVS 2.1.8)
- [ ] Check sign up and password change aginst [https://haveibeenpwned.com/Passwords] (ASVS 2.1.14) (Put it in recommended)

## Expiry
- [ ] Password Expiration: default=never expire; days
- If an expired password is used, after the authentication success, the user needs to change the password to proceed.
- [ ] Password Expiration Warning: default=14; days
- how many days before a password expires to begin displaying password expiration warning messages

## Requirements:
- [ ] Does not allow unicode characters; default=false
- [ ] Restrict consecutive digits: default=false
- [ ] Restrict characters: default=none; string
- [ ] Restrict repeating characters: default=false
- [ ] Require N out of M password policy matches (It only applies to digit, lowercase character, uppercase character, symbol)

## Rate Limit
- [ ] Minimum Time between Password Changes: default=None; hours (1-99) (p.s. this is to be used in combination with password history requirements, so it should be put together or even in a seperate pane

The issue names UI password-policy panes, sign-up and password-change checks, authentication after expiry, and password-change rate limiting, but no files or tests. Start by tracing those entry points and the existing password-policy configuration; done means the listed defaults, validation rules, expiry behavior, and UI grouping are implemented with coverage for each requirement.

Written by the indexing model from the issue text.