Register endpoint missing length caps on prn, srn, password

**Severity:** Low `src/app/api/auth/register/route.ts:71-79`: `prn` and `srn` accept any non-empty string (no length/format cap) and `password` has only a minimum (no maximum). Username/email/name are already bounded. **Fix** Add sensible max-length guards (and format validation for prn/srn if a format is known), consistent with the existing bounded fields. **Acceptance:** over-long `prn`/`srn`/`password` inputs are rejected with a 400.