fix(auth): enforce password bounds, key expiry, and exact node-host binding

.github/workflows/sdk-e2e.yml

@@ -105,6 +105,12 @@ jobs:
           NODE_BASE_URL: "http://localhost:${{ env.SERVER_PORT }}"
           # The e2e coverage recorder writes the endpoints it hit here.
           MERO_COVERAGE_OUT: "${{ github.workspace }}/_mero-js/covered-endpoints.json"
+          # The SDK harness bootstraps the node's first root key, so its password
+          # must satisfy the provider's minimum length (default 8). The harness
+          # would otherwise fall back to its own `dev`/`dev` default and be
+          # rejected at creation.
+          MERO_E2E_USER: dev
+          MERO_E2E_PASS: dev-password
         run: |
           pnpm install --frozen-lockfile
           pnpm test:e2e

apps/blobs/workflows/blobs-example.yml

@@ -21,13 +21,13 @@ steps:
     type: login
     node: node-blob-1
     username: dev
-    password: dev
+    password: dev-password
 
   - name: Login on node-blob-2
     type: login
     node: node-blob-2
     username: dev
-    password: dev
+    password: dev-password
 
   # ============================================================================
   # SETUP: Install Application & Create Context

apps/blobs/workflows/blobs.yml

@@ -18,13 +18,13 @@ steps:
     type: login
     node: rust-blob-1
     username: dev
-    password: dev
+    password: dev-password
 
   - name: Login on rust-blob-2
     type: login
     node: rust-blob-2
     username: dev
-    password: dev
+    password: dev-password
 
   - name: Install Rust blobs app on inviter
     type: install_application

apps/components-demo/workflows/components-demo.yml

@@ -25,13 +25,13 @@ steps:
     type: login
     node: new-calimero-node-1
     username: dev
-    password: dev
+    password: dev-password
 
   - name: Login on new-calimero-node-2
     type: login
     node: new-calimero-node-2
     username: dev
-    password: dev
+    password: dev-password
 
   # Node 1 installs; the installer is config owner, sole settings writer, admin.
   - name: Install Application on Node 1

apps/kv-store-with-shared-storage/workflows/test_shared_storage.yml

@@ -21,13 +21,13 @@ steps:
     type: login
     node: new-calimero-node-1
     username: dev
-    password: dev
+    password: dev-password
 
   - name: Login on new-calimero-node-2
     type: login
     node: new-calimero-node-2
     username: dev
-    password: dev
+    password: dev-password
 
   # Step 1: Install on node 1. Installer becomes the sole initial writer.
   - name: Install Application on Node 1

apps/scaffolding-e2e/workflows/auto-follow/asymmetric-context-membership.yml

@@ -75,13 +75,13 @@ steps:
     type: login
     node: af-asym-node-1
     username: dev
-    password: dev
+    password: dev-password
 
   - name: Login on af-asym-node-2
     type: login
     node: af-asym-node-2
     username: dev
-    password: dev
+    password: dev-password
 
   # ── Phase 1: Bootstrap namespace + both nodes joined ────────────────
   - name: Install application on node-1

apps/scaffolding-e2e/workflows/auto-follow/auto-follow-backfill-on-join.yml

@@ -54,13 +54,13 @@ steps:
     type: login
     node: af-backfill-node-1
     username: dev
-    password: dev
+    password: dev-password
 
   - name: Login on af-backfill-node-2
     type: login
     node: af-backfill-node-2
     username: dev
-    password: dev
+    password: dev-password
 
   # ── Phase 1: Bootstrap with pre-existing contexts BEFORE node-2 joins ─
   - name: Install application on node-1

apps/scaffolding-e2e/workflows/auto-follow/auto-follow-flag-flipped-late.yml

@@ -53,13 +53,13 @@ steps:
     type: login
     node: af-late-flip-node-1
     username: dev
-    password: dev
+    password: dev-password
 
   - name: Login on af-late-flip-node-2
     type: login
     node: af-late-flip-node-2
     username: dev
-    password: dev
+    password: dev-password
 
   # ── Phase 1: Same starting shape as workflow 2 ──────────────────────
   - name: Install application on node-1

apps/scaffolding-e2e/workflows/auto-follow/auto-follow-on-context-registered.yml

@@ -39,13 +39,13 @@ steps:
     type: login
     node: af-baseline-node-1
     username: dev
-    password: dev
+    password: dev-password
 
   - name: Login on af-baseline-node-2
     type: login
     node: af-baseline-node-2
     username: dev
-    password: dev
+    password: dev-password
 
   # ── Phase 1: Bootstrap two-node namespace + subgroup ────────────────
   - name: Install kv-store-with-handlers on node-1

apps/scaffolding-e2e/workflows/auto-follow/no-unknown-context-rejection-spam.yml

@@ -79,13 +79,13 @@ steps:
     type: login
     node: af-no-spam-node-1
     username: dev
-    password: dev
+    password: dev-password
 
   - name: Login on af-no-spam-node-2
     type: login
     node: af-no-spam-node-2
     username: dev
-    password: dev
+    password: dev-password
 
   - name: Install application on node-1
     type: install_application

apps/scaffolding-e2e/workflows/dm-subgroup-privacy.yml

@@ -46,19 +46,19 @@ steps:
     type: login
     node: e2e-node-1
     username: dev
-    password: dev
+    password: dev-password
 
   - name: Login on e2e-node-2
     type: login
     node: e2e-node-2
     username: dev
-    password: dev
+    password: dev-password
 
   - name: Login on e2e-node-3
     type: login
     node: e2e-node-3
     username: dev
-    password: dev
+    password: dev-password
 
   # --- Setup: app + namespace on node-1 (the namespace owner) ---
 

apps/scaffolding-e2e/workflows/e2e.yml

@@ -18,19 +18,19 @@ steps:
     type: login
     node: e2e-node-1
     username: dev
-    password: dev
+    password: dev-password
 
   - name: Login on e2e-node-2
     type: login
     node: e2e-node-2
     username: dev
-    password: dev
+    password: dev-password
 
   - name: Login on e2e-node-3
     type: login
     node: e2e-node-3
     username: dev
-    password: dev
+    password: dev-password
 
   # SETUP: Install app and create mesh
 

apps/scaffolding-e2e/workflows/frozen-rga-convergence.yml

@@ -26,19 +26,19 @@ steps:
     type: login
     node: e2e-node-1
     username: dev
-    password: dev
+    password: dev-password
 
   - name: Login on e2e-node-2
     type: login
     node: e2e-node-2
     username: dev
-    password: dev
+    password: dev-password
 
   - name: Login on e2e-node-3
     type: login
     node: e2e-node-3
     username: dev
-    password: dev
+    password: dev-password
 
   # --- Setup: 3-node mesh ---
   - name: Install application on node-1

apps/scaffolding-e2e/workflows/group-3node.yml

@@ -21,19 +21,19 @@ steps:
     type: login
     node: e2e-node-1
     username: dev
-    password: dev
+    password: dev-password
 
   - name: Login on e2e-node-2
     type: login
     node: e2e-node-2
     username: dev
-    password: dev
+    password: dev-password
 
   - name: Login on e2e-node-3
     type: login
     node: e2e-node-3
     username: dev
-    password: dev
+    password: dev-password
 
   # --- Setup ---
 

apps/scaffolding-e2e/workflows/group-capabilities.yml

@@ -26,13 +26,13 @@ steps:
     type: login
     node: e2e-node-1
     username: dev
-    password: dev
+    password: dev-password
 
   - name: Login on e2e-node-2
     type: login
     node: e2e-node-2
     username: dev
-    password: dev
+    password: dev-password
 
   # --- Setup ---
 

apps/scaffolding-e2e/workflows/group-context-isolation.yml

@@ -22,13 +22,13 @@ steps:
     type: login
     node: e2e-node-1
     username: dev
-    password: dev
+    password: dev-password
 
   - name: Login on e2e-node-2
     type: login
     node: e2e-node-2
     username: dev
-    password: dev
+    password: dev-password
 
   # --- Setup ---
 

apps/scaffolding-e2e/workflows/group-default-capabilities-propagation.yml

@@ -55,13 +55,13 @@ steps:
     type: login
     node: e2e-node-1
     username: dev
-    password: dev
+    password: dev-password
 
   - name: Login on e2e-node-2
     type: login
     node: e2e-node-2
     username: dev
-    password: dev
+    password: dev-password
 
   # --- Setup ---
 

apps/scaffolding-e2e/workflows/group-governance-late-joiner.yml

@@ -22,13 +22,13 @@ steps:
     type: login
     node: e2e-node-1
     username: dev
-    password: dev
+    password: dev-password
 
   - name: Login on e2e-node-2
     type: login
     node: e2e-node-2
     username: dev
-    password: dev
+    password: dev-password
 
   - name: Install application on node-1
     type: install_application

apps/scaffolding-e2e/workflows/group-governance-peer-down.yml

@@ -22,19 +22,19 @@ steps:
     type: login
     node: e2e-node-1
     username: dev
-    password: dev
+    password: dev-password
 
   - name: Login on e2e-node-2
     type: login
     node: e2e-node-2
     username: dev
-    password: dev
+    password: dev-password
 
   - name: Login on e2e-node-3
     type: login
     node: e2e-node-3
     username: dev
-    password: dev
+    password: dev-password
 
   - name: Install application on node-1
     type: install_application

apps/scaffolding-e2e/workflows/group-join-via-inheritance.yml

@@ -50,13 +50,13 @@ steps:
     type: login
     node: join-inherit-node-1
     username: dev
-    password: dev
+    password: dev-password
 
   - name: Login on join-inherit-node-2
     type: login
     node: join-inherit-node-2
     username: dev
-    password: dev
+    password: dev-password
 
   # ── Phase 1: Bootstrap mesh, namespace, Open subgroup, context ────
 

apps/scaffolding-e2e/workflows/group-kick-and-readd-deny-list.yml

@@ -52,19 +52,19 @@ steps:
     type: login
     node: kick-readd-node-1
     username: dev
-    password: dev
+    password: dev-password
 
   - name: Login on kick-readd-node-2
     type: login
     node: kick-readd-node-2
     username: dev
-    password: dev
+    password: dev-password
 
   - name: Login on kick-readd-node-3
     type: login
     node: kick-readd-node-3
     username: dev
-    password: dev
+    password: dev-password
 
   # ── Phase 1: Bootstrap namespace + Restricted subgroup + context ──