fix: security & privacy (rate limiter fix, csrf session cookie, logout on server, drafts stale token passw, login timing, password over 72b, JWT_SECRET complexity, SMTP TLS, CSV export neutralised, fonts bundled, upload metadata, hourly cleanup job, privacy.md report)

internal/infrastructure/useCases/AcceptInvite.go

@@ -66,6 +66,10 @@ func (a *AcceptInviteUseCase) accept(command AcceptInviteCommand, pending invite
 		return user.User{}, err
 	}
 
+	if err := user.ValidatePassword(command.Password); err != nil {
+		return user.User{}, err
+	}
+
 	hashedPassword, err := a.hasher.Hash(command.Password)
 	if err != nil {
 		return user.User{}, err