fix: generate VPN passwords without pwgen, set EDITOR=nano

Use Ansible password lookup on the control node so install works before packages are installed on VPS and without pwgen on macOS. Export EDITOR=nano in Makefile for vault-edit.

roles/hysteria2/tasks/users.yml

@@ -60,16 +60,24 @@
     - update
     - export
 
-- name: Generate missing user passwords with pwgen
-  ansible.builtin.command:
-    cmd: "pwgen -s {{ hysteria2_password_length }} 1"
-  register: _hysteria2_pwgen
-  changed_when: false
-  when: item.password | length == 0
+- name: Generate missing user passwords
+  ansible.builtin.set_fact:
+    _hysteria2_users_with_passwords: "{{ _hysteria2_users_with_passwords | default([]) + [ _entry ] }}"
+  vars:
+    _entry:
+      name: "{{ item.name }}"
+      password: >-
+        {{
+          lookup(
+            'password',
+            '/dev/null chars=ascii_letters,digits length=' ~ (hysteria2_password_length | string)
+          )
+          if item.password | length == 0
+          else item.password
+        }}
   loop: "{{ hysteria2_resolved_users }}"
   loop_control:
     label: "{{ item.name }}"
-    index_var: _hysteria2_user_idx
   tags:
     - install
     - update
@@ -77,25 +85,7 @@
 
 - name: Apply generated passwords
   ansible.builtin.set_fact:
-    hysteria2_resolved_users: "{{ hysteria2_resolved_users | default([]) + [ _entry ] }}"
-  vars:
-    _generated: >-
-      {{
-        _hysteria2_pwgen.results[_hysteria2_user_idx].stdout | default('')
-        if (
-          item.password | length == 0
-          and not (_hysteria2_pwgen.results[_hysteria2_user_idx].skipped | default(false))
-        )
-        else item.password
-      }}
-    _entry:
-      name: "{{ item.name }}"
-      password: "{{ _generated }}"
-  loop: "{{ hysteria2_resolved_users }}"
-  loop_control:
-    label: "{{ item.name }}"
-    index_var: _hysteria2_user_idx
-  when: _hysteria2_pwgen is defined
+    hysteria2_resolved_users: "{{ _hysteria2_users_with_passwords }}"
   tags:
     - install
     - update