Function prompt_new_password 

pub fn prompt_new_password() -> Result<Zeroizing<String>>

Prompt for a new password with confirmation (used during init).

Also respects ENVVAULT_PASSWORD for scripted/CI usage. Enforces a minimum password length.

Returns Zeroizing<String> so the password is wiped from memory on drop.