feat: add script-friendly password output

Support --print-password-only for user add and use it in AWS
bootstrap scripts to capture generated passwords reliably.

Author: pRizz

infra/aws/cloud-init/opencode-cloud-quick.yaml

@@ -111,8 +111,7 @@ write_files:
       log "opencode-cloud setup: bootstrap complete"
 
       log "opencode-cloud setup: create user ${OPENCODE_USERNAME}"
-      user_output="$(opencode-cloud user add "${OPENCODE_USERNAME}" --generate)"
-      OPENCODE_PASSWORD="$(printf '%s\n' "$user_output" | sed -n 's/.*Password: //p' | tail -n 1)"
+      OPENCODE_PASSWORD="$(opencode-cloud user add "${OPENCODE_USERNAME}" --generate --print-password-only)"
       if [ -z "$OPENCODE_PASSWORD" ]; then
         log "opencode-cloud setup: failed to read generated password"
         exit 1

infra/aws/cloudformation/opencode-cloud-quick.yaml

@@ -680,8 +680,7 @@ Resources:
                   fi
 
                   log "opencode-cloud setup: create user $OPENCODE_USERNAME"
-                  user_output="$(opencode-cloud user add "$OPENCODE_USERNAME" --generate)"
-                  OPENCODE_PASSWORD="$(printf '%s\n' "$user_output" | sed -n 's/.*Password: //p' | tail -n 1)"
+                  OPENCODE_PASSWORD="$(opencode-cloud user add "$OPENCODE_USERNAME" --generate --print-password-only)"
                   if [ -z "$OPENCODE_PASSWORD" ]; then
                     log "opencode-cloud setup: failed to read generated password"
                     signal_result 1 "opencode-cloud failed to read generated password"

packages/cli-rust/src/commands/user/add.rs

@@ -22,6 +22,10 @@ pub struct UserAddArgs {
     /// Generate a random secure password instead of prompting
     #[arg(long, short)]
     pub generate: bool,
+
+    /// Print only the generated password for scripting
+    #[arg(long)]
+    pub print_password_only: bool,
 }
 
 /// Generate a secure random password
@@ -60,6 +64,10 @@ pub async fn cmd_user_add(
     quiet: bool,
     _verbose: u8,
 ) -> Result<()> {
+    if args.print_password_only && !args.generate {
+        bail!("--print-password-only requires --generate");
+    }
+
     // Get username - prompt if not provided
     let username = if let Some(ref name) = args.username {
         validate_username(name).map_err(|e| anyhow::anyhow!("{e}"))?;
@@ -124,6 +132,11 @@ pub async fn cmd_user_add(
         save_config(&config)?;
     }
 
+    if args.print_password_only {
+        println!("{password}");
+        return Ok(());
+    }
+
     // Display success
     if !quiet {
         println!(