Collect every password problem

Implement check_password(pw) — every rule is checked, every violation is collected, the order is fixed (length, uppercase, lowercase, digit, whitespace, breach list), and non-string input returns (False, ['must be a string']) before any other rule runs.