Regression from the BUG-013 change: translation and language detection were
requested as a single JSON object, and the model frequently ignored that
contract. QA testing measured roughly 3 in 4 auto-detect translations coming
back empty, while explicit-source translations were unaffected.
Detection is now a separate best-effort call that cannot affect translation, and
an empty model response raises instead of surfacing a blank result.
Also tightens the password rule per QA follow-up on BUG-007: spaces and emoji
were accepted whenever a letter and a digit were also present.
