fix: improve validation guidance and generated password guarantees

[asimawdah]

Summary

Closes #8.

Improves CLI validation guidance, generated secret coverage guarantees, typo/missing-value recovery, ambiguous preset handling, security documentation, human-readable --info diagnostics, and built-in --help discovery. This PR improves the existing branch for issue #8 instead of opening a duplicate.

This cycle extends the same PR with an explicit CLI validation contract, a CLI safety review checklist, and static regression guards wired into npm test, so future edits cannot accidentally remove the most important issue #8 safety boundaries from the implementation or documentation.

Changes

• Adds actionable validation hints for invalid length, missing option values, unknown presets/options, empty character sets, and too-short coverage cases.
• Ensures every enabled character set is represented when the requested length allows it.
• Fails safely when requested length is shorter than enabled-set coverage.
• Adds closest-option suggestions for obvious typoed flags.
• Adds closest-preset suggestions for typoed mode values such as --mode streng.
• Adds explicit support/documentation coverage for standard negated boolean flags such as --no-symbols, --no-upper, --no-lower, and --no-numbers.
• Improves typo recovery for negated boolean flags, so --no-symbl suggests --no-symbols and fails before generating output.
• Tailors missing-value hints by option type and alias, including --length, -l, and --mode.
• Normalizes preset casing and surrounding whitespace for positional and --mode values, so commands like passgen ULTRA and passgen --mode " strong " behave predictably.
• Rejects ambiguous positional preset input instead of silently ignoring extra values, including passgen strong extra and mixed forms like passgen --mode strong ultra.
• Improves --info output by showing selected Mode, active character sets, minimum coverage length, required represented sets, and explicit coverage status while keeping generated passwords on stdout.
• Adds a --help epilogue with usage examples, safe defaults, recommended presets, stdout/stderr behavior, and secret-handling reminders.
• Adds smoke tests for validation paths, stdout/stderr separation, option recovery, negated boolean flags, preset normalization, typoed preset hints, positional preset ambiguity, coverage guarantees, tailored missing-value hints, expanded --info diagnostics, and --help safety guidance.
• Adds docs/CLI_VALIDATION_CONTRACT.md to define output separation, length validation, character-set validation, preset validation, option validation, security guidance, and regression expectations.
• Adds docs/CLI_REVIEW_CHECKLIST.md to turn the issue Fix/Improve: Improve validation, security notes, and CLI output #8 safety requirements into a concrete pre-merge review gate.
• Adds test-validation-contract.js and test-cli-review-checklist.js, both wired into npm test, to guard implementation and documentation drift.
• Updates README validation, coverage, info-output, help-output, recovery-hint, negated-flag, missing-value, review-checklist, and security docs.
• Adds SECURITY.md and includes the validation/review docs in the npm package files allowlist.

Issue review and prioritization

Open issues reviewed in asimawdah/passgen:

1. Fix/Improve: Improve validation, security notes, and CLI output #8 — validation, security notes, and CLI output: selected because it is clear, safety-focused, and has an existing PR that should be improved instead of duplicated.
2. Feature: Add password strength report and export options #7 — strength reports and exports: skipped because it is already covered by PR feat: add strength reports and exports #10.

Validation

• Latest head before merge: a678c39b8b9ae5b6ed120e7bbd57cabf9d943127.
• Base branch: main at 52714bba413177134d83c0d9108105691ff14136.
• GitHub reported this PR as mergeable against main.
• GitHub Actions CI run 28587249819 completed successfully.
• Could not run local tests inside the GitHub connector environment; GitHub Actions is the execution source of truth.

Notes for review

• This improves the existing PR for Fix/Improve: Improve validation, security notes, and CLI output #8 instead of creating a duplicate PR.
• The scope remains limited to validation, security guidance, generated password guarantees, preset recovery, boolean option UX, missing-value hints, --info, CLI help/output clarity, review checklist coverage, and regression guards for those contracts.