feat: password generator with 28-char charset rules

Implements generate_password() function that produces 28-character passwords
following charset rules: position 1 uppercase, position 2 and last lowercase
with restricted characters, middle positions alphanumeric. Uses secrets module
for cryptographic randomness.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

openvpncertupdate.py

@@ -125,6 +125,30 @@ def load_expiring_certs(
 
 
 # ============================================================
+# === PASSWORD ===
+# ============================================================
+
+_BANNED_ALL       = frozenset("oO01lI")
+_BANNED_POS2_LAST = _BANNED_ALL | frozenset("j")
+
+_UPPER            = [c for c in string.ascii_uppercase if c not in _BANNED_ALL]
+_LOWER_RESTRICTED = [c for c in string.ascii_lowercase if c not in _BANNED_POS2_LAST]
+_LOWER_MID        = [c for c in string.ascii_lowercase if c not in _BANNED_ALL]
+_DIGITS_MID       = [c for c in string.digits        if c not in _BANNED_ALL]
+_MID              = _UPPER + _LOWER_MID + _DIGITS_MID   # 55 chars for pos 3-27
+
+
+def generate_password() -> str:
+    pw = [
+        secrets.choice(_UPPER),             # pos 1: uppercase
+        secrets.choice(_LOWER_RESTRICTED),  # pos 2: lowercase, no j
+    ]
+    for _ in range(25):                      # pos 3-27: any safe alphanumeric
+        pw.append(secrets.choice(_MID))
+    pw.append(secrets.choice(_LOWER_RESTRICTED))  # pos 28: lowercase, no j
+    return "".join(pw)
+
+
 # (remaining sections added in later tasks)
 # ============================================================