feat: share.keyRules, how long and varied a share key must be

Sharing refuses a key shorter than minLength characters (default 32,
never under 16) or of fewer than minClasses kinds of lowercase,
uppercase, digits and symbols (default 2, so random hex passes),
saying so without showing it. Opening doesn't check.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs/config.md

@@ -37,6 +37,9 @@ providers:
     exclude: ["**/testdata/**"]
 share:                 # sharing env files as encrypted links
   key: https://kv-team.vault.azure.net/secrets/env-share  # or its lazysecrets:// link; for repos naming none
+  keyRules:            # what a key's value must be
+    minLength: 32      # characters, 16 at least
+    minClasses: 2      # kinds: lowercase, uppercase, digits, symbols
 ```
 
 More, each on its own page: [repos](repos.md) (`providers.repos`),

docs/links.md

@@ -42,8 +42,7 @@ lazysecrets://share/AQ…
 The files are encrypted with a secret's value, so whoever can read that
 secret (in Key Vault, Databricks or a repo's SOPS file) can open the link,
 and nobody else: who may open it is up to the vault's access, as for
-everything else. Make a secret for it once, random and at least 16
-characters:
+everything else. Make a secret for it once, random:
 
 ```sh
 az keyvault secret set --vault-name kv-team --name env-share --value "$(openssl rand -base64 32)"
@@ -63,6 +62,19 @@ With neither, sharing asks which secret, in [Go to](keys.md#go-to): it
 lists only secrets, and `enter` picks one (pasting a reference picks it
 too).
 
+Anyone with a link can try to guess the key, so sharing refuses one that
+isn't long and varied enough, saying how (never showing it). By default
+that's 32 characters of two kinds; your config can ask for more, or less:
+
+```yaml
+share:
+  keyRules:
+    minLength: 32    # characters; 16 at least
+    minClasses: 2    # kinds of character: lowercase, uppercase, digits, symbols
+```
+
+Opening a link doesn't check them.
+
 On the command line, `lazysecrets share [--key <secret>] <env file>...`
 prints the link.