DI token holding the active CngxPasswordStrengthFactory that
CngxPasswordStrength reads. providedIn: 'root' with the dependency-less
createPasswordStrength default, so the directive works without any
provider; override app-wide or per-subtree to swap in a heavier estimator.