feat(webkit): [ENG-47059] add the password-requirements row with default rules

[herbert-julio-azion]

Closes ENG-47059. Implements the password-requirements row from Figma
(FieldPassword 2027:3212, _Must Contain 4770:31936, _Password Requirement Chip
4770:31930, _Score Password 4770:31947).

What the field gains

A captioned, wrapping row of rule chips under the input, enabled by prop. It keeps exactly
two capabilities and nothing else: it is enabled by a prop, and the consumer may
supply their own rules. Everything about how it looks is fixed from the design.

<FieldPassword v-model="password" label="Password" requirements />

A bare requirements renders the built-in set; an array replaces it entirely; false (the
default) renders no row. Each built-in rule carries a stable key so a consumer can start
from the set and drop one without depending on the localizable label.

The chip has two treatments, straight from the design: unsatisfied is
var(--bg-surface-raised) + var(--text-muted) with no glyph, satisfied is
var(--success) + a 14px pi-check + var(--text-default). The chip is wider once
satisfied, which is exactly the 88px to 106px delta between the two Figma variants.

A rule carries its test, not its result: the field owns the value, so it evaluates every
rule against the current one and the chips track what is typed with no wiring on the
consumer side. A g-flagged pattern is rebuilt without the flag, because lastIndex would
otherwise make the same value alternate.

Also in here

• A latent a11y bug: resolvedInputId used ?? against a '' default, so useId() never
  fired and every derived id collapsed to a bare suffix, duplicated across instances with a
  dangling label for and aria-describedby. Now ||, with a test that mounts two id-less
  fields in one app and asserts distinct ids.
• The input's left padding moved from the container onto the <input>, so the strip before
  the text is part of the field and clicking it focuses. input-number already did this;
  input-password did not. group-data-[has-icon-left] keeps the icon-left layout
  pixel-identical.
• The visibility toggle is the 28px small IconButton the frame specifies, and the trailing
  padding is var(--spacing-xs) per the reconciled frame.

The Ctrl+V report: measured, not a defect

Pasting a large text was reported as not counting towards "8-128 characters". Driven with a
real Playwright Ctrl+C/Ctrl+V (OS-level, isTrusted events): a 50-char paste turns all five
chips green; a 300-char paste turns four green and leaves only 8-128 characters grey,
which is what an inclusive 8..128 interval says. The other four lighting up is what makes
the single grey chip read as "the paste was not counted".

Worth recording: the naive probe (dispatchEvent(new ClipboardEvent('paste', …))) yields
isTrusted=false and leaves value.length at 0, so measuring that way would have falsely
confirmed the bug.

If the intent is that a 300-char paste should end up valid, the fix is a maxLength of 128
at the call site so the browser truncates; it is not a change to this component.

What a reviewer should weigh before merge

These are known and deliberate, not oversights:

1. The rule semantics are inferred from the Figma labels, not from the product policy.
   The labels are the design's; the regexes are not in Figma. azion-console-kit enforces
   (?=.*[-_!@#$%^&*(),.?":{}|<>]) for the special character and a minimum of 8 with no
   ceiling, in src/templates/signup-block/login-with-email-block.vue. The shipped default
   uses [^A-Za-z0-9], which is weaker: a plain space satisfies it. Aligning the special
   set, and the key names (minLength / specialChar, which the console already uses in
   src/views/YourSettings/FormFields/FormFieldsYourSettings.vue), is a follow-up.
2. The defaults are a public export (./password-requirements), which deviates from the
   house precedent: field-phone-number's countries.ts is internal, reachable only through
   the prop default. The deviation buys composability (filtering the built-in set by key);
   the precedent's trade is that overriding means passing the whole array.
3. requirements is a union type (boolean | PasswordRequirement[]). No other component
   here uses a union prop; the house shape would be a boolean gate plus an overridable array,
   as calendar-period and field-phone-number do respectively.
4. Four divergences from the design remain: the check glyph should carry
   var(--success-contrast) (the design binds it; the code lets it inherit), the chip height
   is fixed 20px in the design and a floor (min-h-5) in the code, the chip label is
   missing whitespace-nowrap, and the pending-glyph axis is code-only and unreachable with
   the shipped defaults.
5. Client-side rules are guidance, not enforcement. The server is the authority; this row
   must not be read as the password policy.
6. Visual baselines need a CI regeneration for the new and changed stories.

Verified

71 tests pass across field-password and input-password, lint clean, vue-tsc clean, the
89 story files comply with storybook-source.md, check-tests covers 81 components, and the
spec checksum matches.

[CLAassistant]

All committers have signed the CLA.