Fix the security audit's findings

Fixes the nine findings of security audit run 1 on 2.4.1 (T1-T11).

F1: Uploads that are not complete now count only the bytes the server
received, and a chunk that goes above the storage quota gets 422. An
anonymous uploader can no longer fill the quota with declared sizes.

F2: The share password and the admin login have a second limit without
the address (20 attempts per minute per share and per e-mail), because
a forged X-Forwarded-For changes the address.

F3: The system password gate and the admin check now also run on
Livewire updates, so an old uploader snapshot cannot register files.

F4: The session keeps a fingerprint of the system password's hash.
When the admin changes the system password, earlier verifications end.

F5: The page after the upload opens only in the session that created
the share, and only while recipients can still reach the share.

F6: The share password limit counts an attempt before the password is
checked, so parallel attempts cannot pass it.

F7: The system password has the same two limits (5 per address, 20 in
total per minute).

F8: A password change or reset signs the user's other sessions out.

F9: The only admin cannot delete the account, which would open /setup
to every visitor.

The setup wizard also holds the admin password to the password
defaults, and Livewire applies EnsureAdmin to updates.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/Feature/SetupWizardTest.php

@@ -2,6 +2,7 @@
 
 use App\Livewire\SetupWizard;
 use App\Models\User;
+use Illuminate\Validation\Rules\Password;
 use Livewire\Livewire;
 
 test('setup wizard renders when no admin exists', function () {
@@ -38,6 +39,21 @@ test('setup wizard creates admin user', function () {
     expect($admin->is_admin)->toBeTrue();
 });
 
+test('the setup wizard holds the admin password to the password defaults', function () {
+    User::query()->where('is_admin', true)->delete();
+    Password::defaults(fn () => Password::min(12)->mixedCase()->symbols());
+
+    Livewire::test(SetupWizard::class)
+        ->set('name', 'Admin User')
+        ->set('email', 'admin@example.com')
+        ->set('password', 'password123')
+        ->set('password_confirmation', 'password123')
+        ->call('createAdmin')
+        ->assertHasErrors(['password']);
+
+    expect(User::query()->exists())->toBeFalse();
+});
+
 test('setup wizard validates required fields', function () {
     User::query()->where('is_admin', true)->delete();