feat: share.keyRules, how long and varied a share key must be

Sharing refuses a key shorter than minLength characters (default 32,
never under 16) or of fewer than minClasses kinds of lowercase,
uppercase, digits and symbols (default 2, so random hex passes),
saying so without showing it. Opening doesn't check.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/ui/app/sharefiles_test.go

@@ -12,12 +12,16 @@ import (
 
 	"git.kebcloud.no/keb/lazysecrets/internal/provider/fake"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider/repo"
+	"git.kebcloud.no/keb/lazysecrets/internal/share"
 )
 
 // scryptWait is how long the driver waits for encrypting and decrypting,
 // which take about a second on purpose.
 const scryptWait = 20 * time.Second
 
+// demoRules take the demo key, made up to be remembered.
+var demoRules = share.Rules{MinLength: 16, MinClasses: 1}
+
 // cloneWith makes a clone of git.example.com/team/app holding files.
 func cloneWith(t *testing.T, files map[string]string) string {
 	t.Helper()
@@ -35,7 +39,7 @@ func cloneWith(t *testing.T, files map[string]string) string {
 func shareFrom(t *testing.T, root string, paste bool) string {
 	t.Helper()
 	clip := &fakeClipboard{}
-	d := newDriverOpts(t, Options{Clipboard: clip}, fake.Azure(0), repo.New(repo.Settings{Dir: root}))
+	d := newDriverOpts(t, Options{Clipboard: clip, ShareRules: demoRules}, fake.Azure(0), repo.New(repo.Settings{Dir: root}))
 	d.wait = scryptWait
 	if src, ok := d.m.selectedSource(); !ok || src.ID != root {
 		t.Fatalf("selected %v, want the repo", src.ID)