docs(auth): clarify recoverable password storage

[joshtrichards]

• Resolves: #

Summary

• Supersedes: fix(auth): Correct max password length in config.sample.php #54091
• Depends on (a soft dependency; not a hard dependency): fix(auth): correctly size keys for encrypted token passwords #63804
• Related: docs(auth): clarify password storage and length limits documentation#15476
• Historical context: Handle one time password and very large passwords #33110

Clarify the documentation for auth.storeCryptedPassword:

• clearly distinguish the recoverable password copy stored with authentication tokens from the one-way password hash used for account authentication;
• replace the approximate password-length threshold of 300 characters with the actual thresholds, measured in bytes;
• document that passwords longer than 214 bytes require a larger RSA key, increasing token-generation overhead;
• explain that disabling the setting avoids password-length-related RSA key-size increases; and
• clarify that Nextcloud's 469-byte account-password maximum remains enforced whether this option is enabled or disabled.

The 214-byte threshold reflects the corrected RSA-OAEP key-size selection in #63804. It is the actual maximum plaintext size for the existing 2048-bit RSA-OAEP configuration, rather than the approximate 300-character guidance. Before #63804, the implementation switched to a larger key only above 250 bytes, leaving passwords from 215 through 250 bytes assigned to a key too small to encrypt them. (In other words, 214 was already the true cryptographic maximum, but it was not the implemented key-selection threshold before #63804).

TODO

• Backport to v35
• Backport to v34-v33?

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Screenshots before/after for front-end changes
• Documentation (manuals or wiki) has been updated or is not required
• Backports requested where applicable (ex: critical bugfixes)
• Labels added where applicable (ex: bug/enhancement, 3. to review, feature component)
• Milestone added for target branch/version (ex: 32.x for stable32)

AI (if applicable)

• The content of this PR was partly or fully generated using AI