fix(dex): passwordName must match Dex's internal passwordID() — maps non-[a-z0-9-] to '-'

Tapir used human-readable substitutions ('@' -> '-at-', '.' -> '-dot-') when
deriving the Password CR name from an email. Dex's internal passwordID() maps
every non-[a-z0-9-] character to plain '-'. This caused a name mismatch:
Tapir wrote the CR as 'mathias-at-d-ma-dot-be', Dex looked it up as
'mathias-d-ma-be', got not-found, and returned 'Invalid credentials' on every
invite login — while static configmap passwords (a different code path) worked
fine. Diagnosed by adding the email to staticPasswords and confirming login
succeeded, proving the kubernetes CR lookup was the failure point.

internal/adapters/dex/dex_test.go

@@ -42,7 +42,7 @@ func TestCreatePasswordSuccess(t *testing.T) {
 	require.Equal(t, "New.User@Example.com", gotBody.Email)
 	require.Equal(t, "New.User@Example.com", gotBody.Username)
 	require.Equal(t, "user-uuid-1", gotBody.UserID)
-	require.Equal(t, "new-dot-user-at-example-dot-com", gotBody.Metadata["name"])
+	require.Equal(t, "new-user-example-com", gotBody.Metadata["name"])
 	require.Equal(t, "auth", gotBody.Metadata["namespace"])
 
 	// Hash is stored as the raw bcrypt string — Dex compares it directly.
@@ -90,10 +90,14 @@ func TestNewPasswordClientNotInCluster(t *testing.T) {
 }
 
 func TestPasswordName(t *testing.T) {
+	// Must match Dex's internal passwordID() — maps every non-[a-z0-9-] to '-'.
+	// Using a different scheme (e.g. '-at-', '-dot-') causes a name mismatch:
+	// Tapir writes the CR under one name, Dex looks it up under another.
 	cases := map[string]string{
-		"Alice@Example.com": "alice-at-example-dot-com",
-		"a.b+c@gmail.com":   "a-dot-b-c-at-gmail-dot-com",
-		"UPPER@DOMAIN.IO":   "upper-at-domain-dot-io",
+		"Alice@Example.com": "alice-example-com",
+		"a.b+c@gmail.com":   "a-b-c-gmail-com",
+		"UPPER@DOMAIN.IO":   "upper-domain-io",
+		"mathias@d-ma.be":   "mathias-d-ma-be",
 	}
 	for in, want := range cases {
 		require.Equal(t, want, passwordName(in), in)