feat(lagoon): check min and max as length on every non-numeric field (quick-261104-fx1)

- min and max compare the characters of a string or a number's decimal
  form and the element count of a slice or map on any field without
  numeric or integer (Laravel's getSize), with the min.array and
  max.array messages for lists
- blank values, booleans, dates and byte slices are not measured; a
  malformed bound is an error on every non-numeric field
- reverse the 261104-f4x pin, prove it through the cabana settings save
  sequence, and update the README, docs and the storePassword comment

modules/cabana/backend_users_admin.go

@@ -868,9 +868,10 @@ const adminPasswordMinChars = 4
 
 // storePassword hashes a typed password onto user and reports whether one
 // was typed. A password under adminPasswordMinChars characters or over
-// bcrypt's 72-byte limit is a 422 on the field. The length is checked here
-// because the form's min:4 rule is a string rule, which the model validator
-// does not apply.
+// bcrypt's 72-byte limit is a 422 on the field. The form's min:4 rule
+// already refuses a shorter password in lagoon.Validate before this hook
+// runs; the hook repeats the check so it never hashes one, and adds bcrypt's
+// 72-byte limit.
 func (c usersAdmin) storePassword(ctx context.Context, user *BackendUser) (bool, error) {
 	plain := submittedPassword(ctx)
 	if plain == "" {