feat: wire boilerplate to crudauth follow-ups

[emiliano-go]

Wires the boilerplate to the follow-up crudauth APIs and removes the duplicated application auth infrastructure.

Changes:

• configure the shared password policy;
• apply crudauth dynamic rate limiting with request-level principal resolution;
• inject application Redis clients into crudauth;
• use crudauth's configurable OAuth router with JSON responses and browser-bound state;
• preserve the existing auth URL contract where possible;
• update configuration and documentation.

This PR must remain blocked until the following crudauth PRs are merged and released:

• feat: add configurable password policies crudauth#22 (password policy, issue Update README.md #15)
• feat: expose request principal resolution crudauth#23 (request principal resolution, issue Update README.md #16)
• feat: support dynamic rate limits crudauth#27 (dynamic rate limits, issue Docker compose #17)
• feat: accept injected Redis clients crudauth#24 (injected Redis clients, issue Smaller logo #18)
• feat: make OAuth router configurable crudauth#28 (configurable OAuth router, issue Update README.md #19)
• feat: expose safe redirect validation crudauth#25 (safe redirect helper, issue docker compose now working #20)
• fix: bound generated OAuth user fields crudauth#26 (OAuth username bounds, issue Update README.md #21)

The dependency is set to crudauth>=0.7.0,<0.8.0 because that release is required for this branch.