No minimum password length, and say how to reset it

The script refused anything under ten characters. That is a policy the owner
should hold, not one the tooling invents; the only rule left is that the password
cannot be empty, since an empty one would let anyone in. Resetting is the same
script with --force, which overwrites the hash and generates a fresh session
secret, signing out anyone who was signed in - now written down in the operating
notes and the deployment readme, including the form that prompts on your own
machine instead of the server.

ansible/readme.md

@@ -68,7 +68,8 @@ publish something.
 
 The app starts with the admin disabled while `/var/lib/menu.<site>/site.env`
 is missing, and the playbook says so rather than failing. Create it once per
-Site:
+Site; run it again with `--force` to reset the password (a fresh session secret
+signs everyone out). There is no minimum password length.
 
 ```sh
 scp scripts/provision-site-env.sh monoco:/tmp/