feat(cli): relicario generate delegates to core (audit H6)

CLI no longer has its own charset-sampling path — uses the CSPRNG
generate_password / generate_passphrase in relicario-core, which use
rand::distributions::Uniform internally.

crates/relicario-cli/src/main.rs

@@ -1173,7 +1173,34 @@ fn cmd_extract(query: String, aid: String, out: Option<PathBuf>) -> Result<()> {
     eprintln!("Wrote {} bytes to {}", plaintext.len(), out_path.display());
     Ok(())
 }
-fn cmd_generate(_l: u32, _b: bool, _w: u32, _s: String, _sep: String) -> Result<()> { bail!("not yet implemented"); }
+fn cmd_generate(length: u32, bip39: bool, words: u32, symbols: String, separator: String) -> Result<()> {
+    use relicario_core::{
+        generate_passphrase, generate_password, Capitalization, CharClasses,
+        GeneratorRequest, SymbolCharset,
+    };
+
+    let output = if bip39 {
+        generate_passphrase(&GeneratorRequest::Bip39 {
+            word_count: words,
+            separator,
+            capitalization: Capitalization::Lower,
+        })?
+    } else {
+        let symbol_charset = match symbols.as_str() {
+            "safe" => SymbolCharset::SafeOnly,
+            "extended" => SymbolCharset::Extended,
+            other => SymbolCharset::Custom(other.to_string()),
+        };
+        generate_password(&GeneratorRequest::Random {
+            length,
+            classes: CharClasses { lower: true, upper: true, digits: true, symbols: true },
+            symbol_charset,
+        })?
+    };
+
+    println!("{}", output.as_str());
+    Ok(())
+}
 fn cmd_settings(_a: SettingsAction) -> Result<()> { bail!("not yet implemented"); }
 fn cmd_sync() -> Result<()> { bail!("not yet implemented"); }
 fn cmd_device(_a: DeviceAction) -> Result<()> { bail!("not yet implemented"); }