Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@api/password.go`:
- Around line 17-21: The password length check in validatePassword currently
uses len(password) (byte count) which miscounts UTF-8 characters; change the
check to use utf8.RuneCountInString(password) from the unicode/utf8 package so
the policy enforces character (rune) length correctly, update imports to include
"unicode/utf8" if missing, and keep the same unprocessableEntityError message
using config.Security.MinPasswordLength.

In `@api/settings_test.go`:
- Around line 71-74: The test currently decodes into resp (type Settings) so a
missing security_strict key silently becomes false; change the test to first
decode w.Body into a map[string]json.RawMessage (or map[string]interface{}) and
assert that the key "security_strict" exists, then decode into Settings (resp)
and assert resp.SecurityStrict is false; reference the existing symbols resp,
Settings, SecurityStrict, w.Body and json.NewDecoder to locate the change.

---

Nitpick comments:
In `@api/instance_test.go`:
- Around line 78-160: Add a new test method on InstanceTestSuite (e.g.,
TestCreate_SecureByDefaultKeepsConfigLess) that sets
ts.API.config.NewInstancesSecureByDefault = true (restore prev with defer),
creates a POST /instances payload that includes only "uuid" (no "config" key)
using a fresh uuid and operatorToken, calls ts.API.handler.ServeHTTP and asserts
StatusCreated, then load the instance with models.GetInstanceByUUID and assert
that i.BaseConfig is nil (or that Security.Strict is not present) to ensure a
config-less create remains config-less under secure-by-default; follow the same
request/encoding/assert patterns used in TestCreate_SecureByDefaultFlipsEnabled
to match style.

In `@api/password_test.go`:
- Around line 23-29: Add a strict-mode test row to the test cases slice in
api/password_test.go that uses the strict identifier and a multibyte password
value (exactly eight Unicode characters, e.g., eight CJK/emoji characters) and
set the expected result to false so the test asserts character-count (not
byte-count) behavior; place it alongside the existing strict cases (near the
"strict at min" / "strict above min" entries) to lock in multibyte
character-length semantics.

In `@conf/configuration.go`:
- Around line 131-133: The comment for AllowedRedirectURIs is misleading (it
says "exact-match allowlist") while the actual matcher is implemented by
isAllowedRedirectURI and permits path-segment prefix matches (e.g., a configured
"/auth" allows "/auth/cb"); update the comment on AllowedRedirectURIs to
accurately describe this semantics—state that entries are matched by scheme,
host (or host-only) and by path prefix matching on path segments (not strict
exact path equality), and note any normalization rules (trailing slashes,
default ports) that isAllowedRedirectURI applies so operators won't misconfigure
the allowlist.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@api/instance.go`:
- Around line 77-83: The code treats SecurityConfiguration.Strict (bool) the
same for “unset” and explicit false, so update the model and handling to allow
an explicit opt-out: change SecurityConfiguration.Strict from bool to *bool in
conf/configuration.go, update all usages (notably the POST /instances logic that
references params.BaseConfig.Security.Strict and the NewInstancesSecureByDefault
check) to test for nil (treat nil as unset) and only set true when Strict == nil
and NewInstancesSecureByDefault is true, and add a unit test covering explicit
`"security": {"strict": false}` to ensure callers can opt out; alternatively, if
you prefer doc-only fix, update the wording in conf/configuration.go to clearly
state that NewInstancesSecureByDefault overrides both omitted and explicit false
values.