chore: remaining server changes (code quality, go mod tidy)

Go mod tidy, minor server-side adjustments from security verification
and code quality cleanup pass.

Server/auth/password.go

@@ -8,9 +8,9 @@ import (
 )
 
 const (
-	bcryptCost  = 12
-	minPassLen  = 8
-	maxPassLen  = 72 // bcrypt silently truncates beyond 72 bytes
+	bcryptCost = 12
+	minPassLen = 8
+	maxPassLen = 72 // bcrypt silently truncates beyond 72 bytes
 )
 
 // ErrPasswordTooShort is returned when the password is below the minimum length.