[B6/B7] Inject ConfigService into password.utils, move getPasswordHistoryLimit, add tests, update docs

[zakkiyyat]

Closes #711 (B6a) — password.utils.ts: inject ConfigService instead of reading process.env directly
Closes #712 (B6b) — Add unit test confirming getPasswordPolicy reflects env-driven overrides
Closes #713 (B7a) — security.utils.ts: move getPasswordHistoryLimit into AuthService
Closes #714 (B7b) — Document PASSWORD_HISTORY_LIMIT config key in README env-var table

Changes

• src/auth/password.utils.ts: Refactored getPasswordPolicy and validatePassword to accept ConfigService and use configService.get() instead of process.env
• src/auth/auth.service.ts: Updated all callers to pass this.configService; moved getPasswordHistoryLimit as a private method
• src/auth/security.utils.ts: Removed getPasswordHistoryLimit
• test/auth/password.utils.spec.ts: Rewrote tests to use mockConfig() helper instead of process.env overrides; added `getPasswordPolicy) unit tests
• README.md: Added PASSWORD_HISTORY_LIMIT to env-var table

All 199 tests pass.