feat: password generator with 28-char charset rules

Implements generate_password() function that produces 28-character passwords
following charset rules: position 1 uppercase, position 2 and last lowercase
with restricted characters, middle positions alphanumeric. Uses secrets module
for cryptographic randomness.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/test_password.py

@@ -0,0 +1,47 @@
+from openvpncertupdate import generate_password
+
+BANNED_ALL       = set("oO01lI")
+BANNED_POS2_LAST = BANNED_ALL | {"j"}
+
+
+def test_length():
+    assert len(generate_password()) == 28
+
+
+def test_pos1_uppercase():
+    for _ in range(200):
+        pw = generate_password()
+        assert pw[0].isupper(), f"pos1 not uppercase: {pw}"
+
+
+def test_pos2_lowercase_no_banned():
+    for _ in range(200):
+        pw = generate_password()
+        c = pw[1]
+        assert c.islower(), f"pos2 not lowercase: {pw}"
+        assert c not in BANNED_POS2_LAST, f"pos2 banned '{c}': {pw}"
+
+
+def test_last_lowercase_no_banned():
+    for _ in range(200):
+        pw = generate_password()
+        c = pw[-1]
+        assert c.islower(), f"last not lowercase: {pw}"
+        assert c not in BANNED_POS2_LAST, f"last banned '{c}': {pw}"
+
+
+def test_all_alphanumeric():
+    for _ in range(200):
+        pw = generate_password()
+        assert pw.isalnum(), f"non-alphanumeric in: {pw}"
+
+
+def test_no_globally_banned():
+    for _ in range(500):
+        pw = generate_password()
+        for c in BANNED_ALL:
+            assert c not in pw, f"banned '{c}' in: {pw}"
+
+
+def test_uniqueness():
+    assert len({generate_password() for _ in range(100)}) == 100