Password policy

• Minimum 14 characters, no forced rotation.
• Vault entries are named after the service (e.g. jenkins-staging).
• Legacy infrastructure shares one "infrastructure passphrase", recorded in the backup rotation manifest.
• Pre-SSO fallback account on the training lab portal: lab-fallback (uses the infrastructure passphrase).