refactor: unify get_{luks,zfs}_passphrase and get_root_password

Extract the prompt/confirm/min-length loop into prompt_password() in
lib/common.sh using a nameref for the output variable, so UI output
stays on the terminal (no command-substitution capture) and the three
callers collapse from ~30 lines each to a single helper call.

- get_luks_passphrase() — min 8 chars
- get_zfs_passphrase()  — min 8 chars
- get_root_password()   — no min (was unchecked before; preserved)

5 bats tests added: match+min-ok path, length-retry loop,
mismatch-retry loop, min_len=0 disables check, empty passphrase
when min_len=0. make test: 58/58.

1 files changed, 29 insertions, 0 deletions

diff --git a/tests/unit/test_common.bats b/tests/unit/test_common.bats
index 6b9c18f..f0e3e21 100644
--- a/tests/unit/test_common.bats
+++ b/tests/unit/test_common.bats
@@ -86,3 +86,32 @@ setup() {
     [ "$status" -eq 0 ]
     [ -z "$output" ]
 }
+
+#############################
+# prompt_password
+#############################
+
+@test "prompt_password accepts matching value meeting min length" {
+    prompt_password PASS "label" 4 < <(printf 'hello\nhello\n') >/dev/null
+    [ "$PASS" = "hello" ]
+}
+
+@test "prompt_password enforces min length by looping until met" {
+    prompt_password PASS "label" 4 < <(printf 'ab\nab\nlongenough\nlongenough\n') >/dev/null
+    [ "$PASS" = "longenough" ]
+}
+
+@test "prompt_password retries on mismatch" {
+    prompt_password PASS "label" 4 < <(printf 'aaaa\nbbbb\nfinal1234\nfinal1234\n') >/dev/null
+    [ "$PASS" = "final1234" ]
+}
+
+@test "prompt_password with min_len=0 skips length check" {
+    prompt_password PASS "label" 0 < <(printf 'x\nx\n') >/dev/null
+    [ "$PASS" = "x" ]
+}
+
+@test "prompt_password accepts empty passphrase when min_len=0" {
+    prompt_password PASS "label" 0 < <(printf '\n\n') >/dev/null
+    [ -z "$PASS" ]
+}