Password follows NIST more closely, and binds to React Hook Form

• Whole-password comparison: forbidden values and the blocklist are compared with the whole password after removing digits, symbols, leetspeak and repetition. "ali1990" still fails for the name Ali; "kalitelibirsabahkahvesi" no longer does.
• Level by length: A valid password is fair at the minimum, good from 5 characters more and strong from 10 more. Uppercase letters, digits and symbols no longer raise it.
• Repetition: Runs such as "aaaabbbbccccdddd" are rejected.
• useViraPassword(form, schema): The same hook binds to React Hook Form like useViraMask(form, schema): it registers the password and confirm fields and re-checks them against each other; no value, deps or trigger. useViraPassword() without a form works as before.
• mfa preset: 8 characters for a password used with a second factor. legacy is deprecated.
• normalization option: NFKC by default, or NFC as NIST recommends.
• validatePassword(..., { pwned }): The policy and Have I Been Pwned in one call.

Searching the password for a user's name rejected ordinary Turkish words that contain short names like "ali" or "can", and a level that rose with uppercase letters and digits brought composition rules back through the meter. NIST SP 800-63B-4 asks for neither.