What browser-based password strength analysis can and cannot tell you — entropy, patterns, crack-time estimates, and why no breach lookup means limits.