Enhance password-based authentication

## Security Story

### Story context
**(IA-5)**
Explore whether additional password-based management controls could be put in place.

Alternatively, enforce stronger multifactor authentication (yubikey and/or authenticator app) or the use of private PKI-keys for access to protected data

ATO related

### Timeline

By Q3 (December 2026)

### Mitigations for passwords

_These would require us to code in Zitadel_

- [x] Enforce minimum password complexity with case sensitivity, number of characters, mix of upper-case letters, lower-case letters, numbers, and special characters
- [ ] **Enforce at least one character changes when a new password is created**
- [x] Store and transmit only cryptographically-protected passwords

- [ ] ~Enforce password minimum (1 day) and maximum (60 day) lifetime restrictions~
- [ ] ~Prohibit password reuse for 24 generations <-- not feasible at this moment in time~

### Other mitigations

- [ ] Enforce stronger MFA method
- [ ] Enforce PKI key for access to data