PRICE-01 round 2: the token on no page, fixed-tariff note, token length, F3 words, test gaps

F1: every password option is shown as ******** (set) or empty in /config/model
(options, running, ui) and in a stale refusal; the classic page draws it as a
password field; a save or validate that sends ******** or nothing keeps the
stored value. F2: a static_profile beside price_service is said once at start
(notification and log), not refused. F3 (owner, 2026-10-14): the no-price row,
Home line and notification only while maintenance_enabled is on. F4: tests for
the reviewer's R01 and R10. F5: price_service_token must be 16+ characters.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Bdqr7PiaHcBnzPituu2yTC

goodwe_controller/tools/ux13_demo.py

@@ -141,6 +141,8 @@ def _node(name, spec):
                    lengthMin=float(m.group(2)), lengthMax=float(m.group(3)))
     elif spec.startswith("list("):
         out.update(type="select", options=spec[5:-1].split("|"))
+    elif spec == "password":
+        out.update(type="string", format="password")
     elif spec in ("bool",):
         out["type"] = "boolean"
     elif spec in ("int", "float"):