feat: add password change, class unenroll, and optional notify flags

Let admins skip SMS on user, class, and invoice actions, and let users change their own password with the current one.

utils/passwordRules.test.js

@@ -0,0 +1,18 @@
+'use strict';
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert/strict');
+const { assertPasswordStrength, MIN_PASSWORD_LENGTH } = require('./passwordRules');
+
+describe('assertPasswordStrength', () => {
+  it(`rejects passwords shorter than ${MIN_PASSWORD_LENGTH} characters`, () => {
+    assert.throws(() => assertPasswordStrength('ab12'), { errorCode: 'WEAK_PASSWORD' });
+    assert.throws(() => assertPasswordStrength(''), { errorCode: 'WEAK_PASSWORD' });
+    assert.throws(() => assertPasswordStrength(null), { errorCode: 'WEAK_PASSWORD' });
+  });
+
+  it('accepts passwords that meet the minimum length', () => {
+    assert.doesNotThrow(() => assertPasswordStrength('ab1234'));
+    assert.doesNotThrow(() => assertPasswordStrength('longer-secret'));
+  });
+});