Production hardening: password complexity, token refresh, network resilience

Password complexity: real-time validation UI on register, onboarding, and reset screens
  (uppercase, lowercase, digit, min 8 chars) — Compose + iOS Swift
iOS privacy descriptions: camera, photo library, photo save usage strings
Token refresh: Ktor interceptor catches 401 "token_expired", refreshes, retries
Retry with backoff: 3 retries on 5xx/IO errors, exponential delay (1s base, 10s max)
Gzip: ContentEncoding plugin on all platform HTTP clients
Request timeouts: 30s request, 10s connect, 30s socket
Validation rules: split passwordMissingLetter into uppercase/lowercase (iOS Swift)
Test fixes: corrected import paths in 5 existing test files
New tests: HTTP client retry/refresh (9), validation rules

composeApp/src/commonMain/kotlin/com/tt/honeyDue/models/User.kt

@@ -84,6 +84,14 @@ data class AuthResponse(
     val user: User
 )
 
+/**
+ * Token refresh response - returned by POST /api/auth/refresh/
+ */
+@Serializable
+data class TokenRefreshResponse(
+    val token: String
+)
+
 /**
  * Auth response for registration - matching Go API RegisterResponse
  */