Removed symbol requirement for password, fix formatting.

API.md

@@ -9,7 +9,7 @@ GET /api/auth/options — `{ ownerExists }` for registration UX (hide admin-key
 POST /api/auth/login  
 POST /api/auth/logout
 Display names are set during registration and are immutable afterward.
-Passwords must be 8-128 chars and contain uppercase, lowercase, number, and symbol.
+Passwords must be 8-128 chars and contain uppercase, lowercase and number.
 The first account created with a valid `adminKey` becomes both `IsAdmin=true` and `IsOwner=true`.
 
 ## State (requires auth)