feat: enforce minimum password length of 8 characters with warning

[jlima8900]

Summary

The $GEN password generator allows passwords as short as 4 characters. This raises the minimum to 8 and logs a warning when the length is clamped.

Changes

• Minimum length: 4 → 8 (NIST SP 800-63B baseline)
• Warning logged when requested length is below minimum
• Help text examples: $GEN:rand,16 → $GEN (uses default 20)
• Help text: fix typo, document character types
• Default (20) and maximum (200) unchanged
• dice and crypto algorithms unaffected

Why 8, not 16

Legacy systems (mainframes, older databases, some LDAP implementations) enforce max password lengths of 8-14 characters. Setting minimum to 16 would make Commander unusable for those systems. 8 is the NIST SP 800-63B baseline and accommodates legacy constraints while eliminating trivially weak passwords.

The warning ensures users know when their requested length was adjusted.

Test plan

• $GEN generates 20-character password (default, unchanged)
• $GEN:rand,24 generates 24-character password
• $GEN:rand,6 generates 8-character password + logs warning
• $GEN:rand,4 generates 8-character password + logs warning
• $GEN:rand,8 generates 8-character password, no warning
• $GEN:dice,5 unaffected
• $GEN:crypto unaffected

[jlima8900]

Note on enterprise password policy:

generate_password() does not consult the enterprise enforcement policy (PasswordRule / DomainPasswordRulesRequest). An enterprise admin can enforce minimum 16 characters with symbols, but $GEN:rand,4 would produce a 4-character password with no validation against that policy.

This PR raises the hardcoded floor from 4 to 8 as a safety net, but the deeper fix would be for generate_password() to check the enterprise password rules when available and use those as the minimum instead of a static value.

That's a larger change (requires params access in generate_password(), API call to fetch rules) — noting it here as a follow-up consideration.

[aaunario-keeper]

don't submit PRs against master, do it against release branch instead
also, are we sure 4 isn't an expected minimum (are we sure that admins don't have the ability to set it to that currently?)
ideally we'd want to fix this properly and avoid relying on half-measures as you pointed out, have you made the corresponding JIRA ticket?