fix(iam): [P0] no password strength validation on signup — any single-character password accepted

Problem

In internal/services/iam/server.go:handleSignup (line ~99), the only password validation is checking that it is non-empty after trimming:

func validSignupPayload(email, password, name, organizationName, organizationKind string) bool {
    if strings.TrimSpace(email) == "" || strings.TrimSpace(password) == "" || strings.TrimSpace(name) == "" {

This means users can sign up with passwords like "a" or "1". For a platform handling financial transactions (invoices, settlements, credit decisions), this is a critical security gap. Attackers can trivially brute-force accounts.

Additionally, there is no email format validation — any non-empty string is accepted as an email address.

Files

• internal/services/iam/server.go:handleSignup — missing password complexity check
• internal/services/iam/server.go:validSignupPayload — only checks non-empty
• internal/identity/store.go:CreateSignup (MemoryStore) — no validation at store level either

Suggested Fix

1. Add password strength requirements (minimum 8 chars, at least one letter + one digit)
2. Add basic email format validation (must contain @ with non-empty local and domain parts)
3. Consider adding these as package-level validation functions in internal/identity/ so both memory and postgres paths share them
4. Add tests for rejected weak passwords and malformed emails

func validatePassword(password string) error {
    if len(password) < 8 {
        return errors.New("password must be at least 8 characters")
    }
    var hasLetter, hasDigit bool
    for _, c := range password {
        if unicode.IsLetter(c) { hasLetter = true }
        if unicode.IsDigit(c) { hasDigit = true }
    }
    if !hasLetter || !hasDigit {
        return errors.New("password must contain at least one letter and one digit")
    }
    return nil
}

Priority

P0 — Direct financial platform security risk. Weak credentials enable account takeover.