feat(escrow): enforce a minimum passphrase length node-side in ExportCAKey and ImportCAKey

[Bugs5382]

Summary

The node's ExportCAKey/ImportCAKey RPCs currently only check that the passphrase is non-empty. The manager and web enforce a minimum of 18 characters for the parity path, but the node's own CLI/local path does not, so a short passphrase can still seal a backup when it is driven directly.

Add node-side enforcement of the same minimum (at least 18) in both RPCs so every escrow path, including the CLI, meets the floor. Reject a shorter passphrase with InvalidArgument, and ensure the error never echoes the passphrase.

Acceptance criteria

• ExportCAKey rejects a passphrase shorter than the minimum with InvalidArgument.
• ImportCAKey rejects a passphrase shorter than the minimum with InvalidArgument.
• The rejection message does not contain the passphrase.
• Tests cover both RPCs at and below the boundary.

Notes

Follow-up to the manager/web CA key escrow slice (CryptOS-PKI/manager#33). The manager already enforces at least 18 as defense in depth; this closes the CLI/local gap.