Replace @randyd45/curp-validation with validate-curp

[ricardobcl]

Description

v11.0.0 replaced the GPL-licensed curp lib with @randyd45/curp-validation (#287), but the two are not equivalent: curp.validar() validated the CURP check digit, while @randyd45/curp-validation's isFormatValid() only tests the format regex — the 18th character is matched by (\d) but never verified. Both libraries use the same regex, so the swap silently made the assert strictly more permissive.

Verified empirically — same 17-character prefix, all ten possible check digits:

CURP	curp@1.2.3	@randyd45/curp-validation@1.0.4
SABC560626MDFLRN01 (correct digit)	✅	✅
SABC560626MDFLRN00, 02…09	❌	✅

9 of 10 previously-rejected values pass v11. The check digit is a weighted mod-10 sum over the 17 preceding characters — it is what catches single-character typos and transpositions anywhere in the CURP.

This PR replaces @randyd45/curp-validation with validate-curp (MIT, same author as the validate-rfc lib already backing the RfcNumber assert), mirroring the RfcNumber assert one-to-one. validate-curp restores check-digit validation — its algorithm is identical to the original curp lib's (same 37-character dictionary, weights 18 - i, mod 10) — and additionally validates the state code (including NE) and RENAPO's forbidden-word list (identical to curp's 81-word malasPalabras list).

Behavioral notes:

• Like validate-rfc, validate-curp normalizes input before validating (trim, uppercase, strip non-alphanumerics), so e.g. lowercase CURPs are now accepted — consistent with how RfcNumber behaves today.
• The forbidden-word check is stricter than the original curp.validar(), which never checked it (only generar() substituted forbidden words). Genuine RENAPO-issued CURPs never carry those prefixes.

Also adds a check-digit negative test — the test that would have caught this in #287.

Related issues

Follow-up to #287. Affects uphold/backend#18451.

Impacted areas

• CurpNumber assert.

Steps to reproduce or test

Development

yarn test

523/523 passing, including the new check-digit case.

QA

N/A

Checklist

• Add label Breaking Change if it applies.
• Commits are atomic and logically separated.
• Performance implications have been considered.
• Security implications have been considered.
• The new and updated code has good coverage.
• API documentation, if required, has been created or updated.
• New dependencies have been added to package.json.
• The README file, if required, has been updated.
• Architectural diagram, if required, has been updated.

Deploy notes

Peer dependency change (@randyd45/curp-validation → validate-curp), so the next release should be a major (v12.0.0). Consumers must swap the optional peer dependency when upgrading.