feat(07-07): replay the 15 user-api routes and both nuxt auth flows

Match PHP payloads, already-activated Winter 500 HTML, and direct-DB
seeding so the corpus can flip those routes to ported without onboarding.

Co-authored-by: Cursor <cursoragent@cursor.com>

models/user.go

@@ -55,8 +55,9 @@ func (User) Hidden() []string {
 // Rules is the register-time rule set. confirmed covers password_confirmation.
 func (User) Rules() map[string]string {
 	return map[string]string{
-		"email":    "required|between:6,255|email|unique:users",
-		"password": "required|between:8,255|confirmed",
+		"email":                 "required|between:6,255|email|unique:users",
+		"password":              "required|between:8,255|confirmed",
+		"password_confirmation": "between:8,255",
 	}
 }