Enforce Minimum Length for Usernames

Is your feature request related to a problem? Please describe.

Currently, Nextcloud allows the creation of usernames with fewer than three characters. This can lead to administrative challenges, especially in environments with strict naming conventions or external integrations, such as LDAP or Active Directory. Short usernames may also reduce usability and clarity for end users.

Describe the solution you'd like

I propose implementing a configurable option to enforce a minimum username length, with the following features:

Introduce a configuration parameter in config.php (e.g., min_username_length) to define the minimum username length.
Add validation during username creation (both in the UI and via the API).
Default the minimum length to 3 characters if no specific value is set.
Provide clear error messages for rejected usernames, such as:
"Usernames must be at least X characters long."
Describe alternatives you've considered

Manually enforcing the rule via external scripts or middleware.
Using LDAP or other external systems to validate username length.
Both approaches are less efficient and harder to manage compared to a built-in validation mechanism in Nextcloud.

Additional context

This feature aligns with existing password policies in Nextcloud, ensuring consistency in user management.
It will improve usability and reduce potential issues with third-party integrations.
Example Implementation:

// Example config.php addition
'min_username_length' => 3,

Community Relevance:
This feature would be especially useful for administrators managing large installations or those who rely on integrations with external systems requiring stricter naming conventions.

References:
No existing issues found in the repository matching this feature request.

Start by tracing username creation through the UI and API, then compare the existing password-policy configuration and validation paths. Review how config.php options are defined and surfaced, and identify where a default minimum of three characters and a clear rejection message would apply. Done means both creation paths enforce the configured limit consistently.