feat(admins): configurable password generator

[Rushaway]

Summary

Adds a configurable password generator to every panel form that sets a credential:

• Add admin: web password + in-game admin password
• Edit admin: web password + in-game admin password
• Your account: new password + new server password (only shown to web admins, matching the existing admins.generate_password gate)
• Add / Edit server: RCON password

Each generate button opens one shared dialog. It shows a random password and lets the admin:

• change the length (slider or exact number)
• turn lowercase, uppercase, digits, symbols, and look-alike filtering (0 O 1 l I) on or off
• copy the value
• click Use password to fill the field and its confirmation

Owners set the starting options under Settings > Main > Password generator defaults.

Implementation

• Sbpp\Security\PasswordGenerator (new): the only place passwords get generated.
  • Uses random_int, puts at least one character from every enabled set, then runs a Fisher-Yates shuffle.
  • Clamps length to [max(8, config.password.minlength), 128], so a generated password always passes the panel's own minimum.
  • Symbols leave out quotes, backslash, ;, space, and backtick, so values are safe in server.cfg and SourceMod configs.
• Settings: six new config.password.generator.* rows. They are seeded in data.sql and backfilled for upgraded installs by updater migration 813 (INSERT IGNORE, idempotent). REST PATCH /settings types the new keys as bool / int.
• admins.generate_password: now accepts optional length / lowercase / uppercase / digits / symbols / exclude_ambiguous. Missing options fall back to the defaults. The response echoes the effective options plus min_length / max_length. If every character set is off, it returns a validation error on field charset. The permission gate is unchanged. api-contract.js is regenerated.
• web/scripts/password-generator.js (new, // @ts-check): one document-level delegate for [data-password-generator][data-password-targets="id,id2"], loaded from core/footer.tpl. It replaces the page-local generator handler on Add admin.
• REST POST /admins now builds its fallback password with the same generator. Crypto::genPassword() had no callers left and is removed.
• Docs: added a "Generating passwords" section to docs/.../setup/admins-and-groups.md, a namespacing row and a "Where to find what" row in AGENTS.md, and a directory-layout line in ARCHITECTURE.md.

Test plan

• PHPStan: no errors
• ts-check: passes
• API contract regenerated
• PHPUnit:
  • new PasswordGeneratorTest: length clamping, per-set guarantee, look-alike exclusion, console-safe symbols, empty-set rejection, plus a check that the keys and defaults match between data.sql and 813.php
  • new AdminsTest::testGeneratePassword*: request options, length clamp, empty charset, configured defaults
  • updated snapshots: generate_password_success, youraccount_owner
  • the remaining failures in AdminsTest are the local CRLF snapshot baseline and also fail on main
• Playwright (chromium, workers: 1):
  • new password-generator.spec.ts: options shape the output, empty charset blocks "Use password", configured defaults seed the dialog, Settings save round-trip, Edit admin, Your account, axe check
  • updated admins-add-form.spec.ts
  • settings / account / a11y specs still pass, except the SMTP happy path, which needs a mailpit container that wasn't running locally
• Manual: open the dialog on each surface in light and dark mode (checked locally on Your account)

🤖 Generated with Claude Code