Add Password Generator tool

[02karthik]

What is this tool?

Password Generator — a productivity/security tool that creates strong, random passwords right inside the Hillnote workspace. Everything happens locally: nothing is ever sent anywhere. Useful for anyone who needs a quick, trustworthy password without reaching for a separate site.

Highlights:

• Cryptographically strong randomness — uses crypto.getRandomValues (never Math.random), rejection-sampled to avoid modulo bias so no character class is subtly favoured.
• Full control — length slider (4–64) and toggles for uppercase, lowercase, numbers, and symbols, plus an "avoid ambiguous characters" option (skips I l 1 O 0, etc.).
• Guaranteed variety — seeds at least one character from each selected class, then shuffles (Fisher–Yates over the same secure source).
• Live strength meter — entropy computed as length × log2(poolSize), shown as bits and a four-segment meter (Weak → Very strong).
• One-tap copy — clipboard API with a document.execCommand fallback and a toast confirmation.
• Settings persist in localStorage under the namespaced key password-generator:v1.

Designed to the Hillnote design system: azure #4d63ff primary, cool-mist canvas, near-black ink, Manrope-900 display headline, and the signature 24px card radius.

Checklist

• It's a single file: password-generator/index.html with all CSS + JS inline.
• It is fully self-contained / offline — no remote fonts, scripts, styles, images, fetch, or import.
• No analytics, trackers, or phone-home behavior.
• Added a screenshot at screenshots/password-generator.webp (via npm run screenshot password-generator).
• Registered the tool in tools.json (dir matches the folder name).
• Bumped the top-level catalogVersion (18 → 19).
• For an update to an existing tool: incremented that tool's version. (N/A — new tool at version 1.)
• npm run validate passes locally.

Notes for reviewers

• Randomness is generated per-character via rejection sampling in randInt — the discarded high bytes keep the distribution uniform for any pool size.
• The UI never allows zero character types: clearing the last active toggle re-enables it and briefly warns the user.
• Copy has a graceful fallback for environments where the async clipboard API is unavailable or blocked under CSP.
• Character sets are written as plain literal strings (no String.fromCharCode) so the source stays clear and out of the validator's obfuscation warnings.

---

Generated by Claude Code