Add password policy module (libpam-pwquality)

[ranjith-src]

What

Add a password module that installs libpam-pwquality and writes /etc/security/pwquality.conf with sensible defaults (minlen=12, complexity requirements).

Why

Even with key-only SSH, passwords still matter for:

• sudo authentication
• su to switch users
• Console/VNC access from VPS provider dashboard
• Any PAM-authenticated service

A weak password on the deploy user means an attacker who gains any foothold can escalate via sudo.

Suggested implementation

Install libpam-pwquality and write config:

# /etc/security/pwquality.conf
minlen = 12
dcredit = -1
ucredit = -1
lcredit = -1
ocredit = -1
enforce_for_root

Add verification: check that libpam-pwquality is installed and config file exists with expected minlen.