#11 fix SASL login failures with non-ASCII passwords

- Normalize SCRAM passwords with RFC 4013 SASLprep before the
  challenge response, so they match SASLprep-compliant servers
  (Martin hashes raw UTF-8) and PLAIN still sends the password
  untouched.
- Capture the raw <failure/> condition with LumaSaslFailureModule and
  map SASL errors to actionable Russian messages instead of the
  cryptic OS-localized "Martin.SaslError, error 5".
- Cover SASLprep and failure message mapping with unit tests and new
  verify.sh invariants.

Scripts/verify.sh

@@ -81,6 +81,11 @@ required=(
   Tests/MessageReplySwipeTests.swift
   Tests/WatchVoiceMessageTests.swift
   Tests/ArchiveStoreTests.swift
+  Tests/SASLprepTests.swift
+  Tests/SaslFailureMessageTests.swift
+  Sources/Shared/XMPP/SASLprep.swift
+  Sources/Shared/XMPP/LumaSaslFailureModule.swift
+  Sources/Shared/XMPP/SaslFailureMessage.swift
   Sources/Shared/Models/ChatMessage.swift
   Sources/Shared/Models/Conversation.swift
   Sources/Shared/Persistence/ArchiveStore.swift
@@ -295,6 +300,18 @@ grep -q 'completeUntilFirstUserAuthentication' Sources/Shared/Persistence/Archiv
   echo "The SwiftData store must keep the data protection attribute"
   exit 1
 }
+grep -q 'SASLprep' Sources/Shared/XMPP/XMPPService.swift || {
+  echo "SCRAM passwords must be RFC 4013 (SASLprep) normalized"
+  exit 1
+}
+grep -q 'LumaSaslFailureModule' Sources/Shared/XMPP/XMPPService.swift || {
+  echo "The raw SASL failure condition must be captured for the UI"
+  exit 1
+}
+grep -q 'Сервер отклонил имя пользователя или пароль' Sources/Shared/XMPP/SaslFailureMessage.swift || {
+  echo "SASL failures must produce an actionable Russian message"
+  exit 1
+}
 grep -q 'ArchiveSyncCursorPolicy.requestPosition' Sources/Shared/XMPP/XMPPService.swift || {
   echo "MAM reconnects must prefer the durable archive UID over timestamps"
   exit 1