NIST-aligned password policy with HIBP breach checking, layered failed-login lockout, and an audit log.