SSO registration accepted no password, so GitHub-made accounts got a one-time app password and nothing to log into Bluesky with afterwards. complete-registration now takes an optional `password`, checks it with validate_password before any account work, and stores it with set_new_user_password once the account exists. With a password set, no initial app password is generated; if storing it fails the old app password path still runs so the user is never locked out. The SSO completion page asks for the password (with a show toggle), and both forms now check the server's rules client-side (8+ characters, upper and lowercase, a digit) with a hint that says so. Tests: sso.rs covers sign-up with a password (no appPassword, then createSession works) and a weak password (400, pending registration kept); vitest covers the client-side rule and the SSO page sending the password.