docs(tinystruct): validate example login inputs before authentication

Add null, blank and example-specific UTF-16 length checks to the English and Japanese login snippets before AuthService. Preserve credential bytes, authentication-failure behavior and the existing successful-session flow. Label the 256/1024 limits as application examples rather than tinystruct defaults.

Compile and execute exact extracted methods against controlled request/auth/session stubs with ephemeral official checksum-verified Temurin17. Baseline: 8 pass,20 fail. Candidate:28 pass,0 fail. Tagged Request API and Java17 target verified. Markdownlint, Unicode and diff checks pass. Root independently reviewed both documents. No full HTTP host, real authentication service, cookie-policy or envelope changes claimed; registry rebound remains root-owned.

docs/ja-JP/skills/tinystruct-patterns/SKILL.md

@@ -136,12 +136,23 @@ public class MyService extends AbstractApplication {
 ```
 
 ### HTTPモード分岐（login）
+
+以下の長さ制限は UTF-16 コード単位で数えるアプリケーション側の設定例であり、tinystruct のデフォルトではありません。認証サービスの方針に合わせてください。空白だけの認証情報は拒否しますが、認証に渡す値をトリミングしたり変更したりしません。
+
 ```java
 @Action(value = "login", mode = Mode.HTTP_POST)
 public String doLogin(Request<?, ?> request) throws ApplicationException {
     String username = request.getParameter("username");
     String password = request.getParameter("password");
 
+    final int maxUsernameLength = 256;
+    final int maxPasswordLength = 1024;
+    if (username == null || password == null
+            || username.length() > maxUsernameLength || password.length() > maxPasswordLength
+            || username.isBlank() || password.isBlank()) {
+        throw new ApplicationException("Invalid credentials");
+    }
+
     // AuthService はアプリケーション独自のクラスであり、tinystruct の一部ではない
     String userId = AuthService.getInstance().authenticate(username, password); // 失敗時は null
     if (userId == null) {

skills/tinystruct-patterns/SKILL.md

@@ -136,12 +136,23 @@ public class MyService extends AbstractApplication {
 ```
 
 ### HTTP Mode Disambiguation (login)
+
+The limits below are example application policy measured in UTF-16 code units, not tinystruct defaults. Align them with your authentication service. Reject blank credentials without trimming or otherwise changing the values passed to authentication.
+
 ```java
 @Action(value = "login", mode = Mode.HTTP_POST)
 public String doLogin(Request<?, ?> request) throws ApplicationException {
     String username = request.getParameter("username");
     String password = request.getParameter("password");
 
+    final int maxUsernameLength = 256;
+    final int maxPasswordLength = 1024;
+    if (username == null || password == null
+            || username.length() > maxUsernameLength || password.length() > maxPasswordLength
+            || username.isBlank() || password.isBlank()) {
+        throw new ApplicationException("Invalid credentials");
+    }
+
     // AuthService is your application's own class, not part of tinystruct
     String userId = AuthService.getInstance().authenticate(username, password); // null on failure
     if (userId == null) {