PRICE-01 round 2: the token on no page, fixed-tariff note, token length, F3 words, test gaps

F1: every password option is shown as ******** (set) or empty in /config/model
(options, running, ui) and in a stale refusal; the classic page draws it as a
password field; a save or validate that sends ******** or nothing keeps the
stored value. F2: a static_profile beside price_service is said once at start
(notification and log), not refused. F3 (owner, 2026-10-14): the no-price row,
Home line and notification only while maintenance_enabled is on. F4: tests for
the reviewer's R01 and R10. F5: price_service_token must be 16+ characters.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Bdqr7PiaHcBnzPituu2yTC

goodwe_controller/app/validate.py

@@ -1721,6 +1721,10 @@ def _price_problems(opts: dict, notes: list | None = None) -> list[str]:
             problems.append(
                 f"{S('price_service_token')} has a space or a line break in "
                 "it. Paste the token again, with nothing around it.")
+        elif len(token) < PRICE_TOKEN_MIN:
+            problems.append(
+                f"{S('price_service_token')} is too short. Paste the whole "
+                "token.")
 
     return problems
 
@@ -1778,6 +1782,11 @@ def _entities_read(opts: dict) -> list[tuple[str, str, str]]:
     return out
 
 
+# PRICE-01 F5. A shorter value is not a token; it also could not be scrubbed
+# from a log (price.scrub skips values under 4 characters).
+PRICE_TOKEN_MIN = 16
+
+
 def config_notes(opts: dict, *, entities: dict | None = None,
                  month_peak_w=None) -> list[Note]:
     """UX-13: warnings that need live data, for the settings page. Never a