Add password autocomplete check (#139)

[jthack]

Summary

• flag password inputs that omit autocomplete protections or explicitly enable it
• report low-severity findings with the field index and attribute value
• register the passive check and enable it in the Balanced preset

Testing

• pnpm lint
• pnpm typecheck
• pnpm test -- --match 'Password autocomplete'

Closes #139