fn extract_user_inputs(username: &str) -> Vec<String>Expand description
Extract meaningful tokens from username/email for password penalization.
Handles both email addresses and plain usernames:
- For emails: extracts and tokenizes the local part (before @)
- For usernames: tokenizes the entire string
- Splits on non-alphanumeric characters and converts to lowercase