fix(security): validate demo user password against project policy

[engalar]

Summary

• Adds PasswordPolicy.ValidatePassword() method in sdk/security/ that checks password against MinimumLength, RequireDigit, RequireMixedCase, and RequireSymbol settings
• Wires validation into execCreateDemoUser so CREATE DEMO USER rejects non-compliant passwords at creation time with a clear error message and hint
• Previously, non-compliant passwords were silently accepted but the Mendix runtime would skip creating the user, leading to confusing "Login FAILED: unknown user" errors

Closes #137

Test plan

• Unit tests for ValidatePassword: valid password, too short, no digit, no mixed case, no symbol, empty, nil policy, zero policy (9 cases)
• Full test suite passes (make test)
• Manual verification with real MPR: CREATE DEMO USER 'test' PASSWORD '1' (User) should fail with policy violation error

🤖 Generated with Claude Code

[github-actions]

AI Code Review

What Looks Good

• Addresses user confusion: Fixes the silent failure issue where non-compliant passwords were accepted but led to confusing "Login FAILED: unknown user" errors
• Clear error messages: Provides specific policy violation details with actionable hint ("hint: check your project's password policy with SHOW PROJECT SECURITY")
• Comprehensive testing: Unit tests cover all validation scenarios (valid, too short, no digit, no mixed case, no symbol, empty, nil policy, zero policy)
• Minimal, focused changes: Only touches necessary files (sdk/security/ and mdl/executor/cmd_security_write.go)
• Proper nil/zero handling: Correctly handles nil policy (accepts any password) and zero-value policy fields
• Follows existing patterns: Implementation matches Go conventions and existing codebase style

Recommendation

Approve - The PR successfully resolves the reported issue with appropriate validation, clear error messaging, and thorough testing. No MDL syntax changes were introduced, so full-stack consistency requirements don't apply. The changes are scoped to a single concern (password validation for demo users) and maintain code quality standards. The unit test coverage is comprehensive and the full test suite passes. Manual verification with real MPR is pending but the backend logic is sound.

---

Automated review via OpenRouter (Nemotron Super 120B) — workflow source

[ako]

Clean fix for a confusing UX problem — silently non-compliant passwords leading to "unknown user" at runtime is a real gotcha.

• ValidatePassword() is straightforward with correct nil/zero-value edge cases
• Good test coverage (8 cases including nil and zero policy)
• Error message with SHOW PROJECT SECURITY hint is helpful
• Validation before duplicate-user check is the right order

LGTM.