KC-1352 Modernize pam project import --sample-data (no hardcoded credentials)

[idimov-keeper]

Replaces the hard-coded --sample-data block in edit.py with a single
pam_import/playground.py module. All sample data is generated per run.

Changes

• New playground.py: generates vault records, credentials, docker-compose.yaml
  and docker-seccomp.json for the discovery playground — no secrets in source.
• Credentials generated once per run and shared between the vault records and the
  compose; comply with the enterprise password policy (random password meeting the
  policy's rules, matching the Web Vault) and use only shell/JSON/YAML-safe chars.
• RSA-2048 SSH keypair generated at runtime (replaces the static PRIVATE_KEY).
• Record creation switched to the typed record-add command (dot-notation fields),
  removing the legacy "Unknown field types" noise; expected policy/BreachWatch
  warnings suppressed only for the image-fixed OpenLDAP demo creds.
• docker-compose.yaml: top-level name: from --name; Docker auto-assigns the
  network subnet (avoids pool overlaps); gateway uses keeper/gateway:latest,
  base64 GATEWAY_CONFIG, and debug logging.
• PAM config network_id derived from the project name (matches the compose network).
• --sample-data prints only two lines (compose path + seccomp URL) and exits;
  --output is ignored under -s, --name is honored.
• Fixes: PostgreSQL connection database (postgresql→postgres); rotation settings
  now persist (sync before configuring rotation); OpenLDAP demo users are rotatable
  and carry the distinguishedName kdnrm needs.
• OpenLDAP directory added (tunnel + rotation). MongoDB uses the correct mongodb
  protocol but is commented out with an explanation — its KeeperDB connect needs
  gateway ConversationType support that isn't shipped yet.