feat: share.keyRules, how long and varied a share key must be

Sharing refuses a key shorter than minLength characters (default 32,
never under 16) or of fewer than minClasses kinds of lowercase,
uppercase, digits and symbols (default 2, so random hex passes),
saying so without showing it. Opening doesn't check.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/share/share.go

@@ -40,7 +40,7 @@ const (
 	// MaxLink keeps a link short enough for chat and tickets (Teams takes
 	// about 28 KB) and for passing it to a terminal window.
 	MaxLink = 16 << 10
-	// MinKey is the shortest secret value accepted as a key.
+	// MinKey is the shortest key the rules can ask for.
 	MinKey = 16
 	// maxFiles caps what opening a link unpacks.
 	maxFiles = 1 << 20
@@ -85,13 +85,14 @@ type file struct {
 	Data string `json:"data"`
 }
 
-// Seal encrypts files with key, the value of h.Key, into a share link.
-func Seal(h Header, key []byte, files []File) (ref.Ref, error) {
+// Seal encrypts files with key, the value of h.Key, into a share link,
+// if key keeps to rules.
+func Seal(h Header, key []byte, files []File, rules Rules) (ref.Ref, error) {
 	if _, err := ParseKey(h.Key.String()); err != nil {
 		return ref.Ref{}, fmt.Errorf("the key: %w", err)
 	}
-	if len(key) < MinKey {
-		return ref.Ref{}, fmt.Errorf("the key's value is %d characters: use a random one of at least %d", len(key), MinKey)
+	if err := rules.Check(key); err != nil {
+		return ref.Ref{}, err
 	}
 	if len(files) == 0 {
 		return ref.Ref{}, errors.New("no files to share")