fix(boot-test): run every boot test with exactly what a new server gets

CI's boot test gave every blank password-like setting a throwaway value. A
real deploy only fills x-generate fields, so a template whose server won't
start without one passed CI and failed for the first owner who deployed it.

boottest-payload now fills only x-generate fields, for CI and the builder
alike. The old behaviour is kept as -fill-blank-passwords, used only by
the builder's second boot to tell whether an empty setting is why a draft
fails. Messages and AUTHORING.md no longer say boot tests fill passwords;
a server that needs a join password gets x-generate.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

AUTHORING.md

@@ -34,6 +34,8 @@ Know this before writing anything:
   **Never put a placeholder or default password in a template.** Shared defaults are readable by anyone
   from the public game list.
 - Join passwords stay `""`, with `"x-savedValue": {"key": "GAME_JOIN_PASSWORD", "label": "Game join password", "secret": true}`.
+  If the server can't start without one, give it `"x-generate": {"type": "password"}` as well, so every new server
+  gets its own. Boot tests run with exactly what a new server gets: empty settings stay empty.
 - No real credentials, tokens or IDs anywhere in this repo. A value a server can't start without (a
   player ID, a license token) goes in `test.yaml` under `secrets`, mapped to a CI secret name.