Improve passwords handling when provided from stdin (related to #7)

[kwart]

Summary

Follow-up to #357, addressing items surfaced by a post-merge review of the stdin-password feature.

1. Decouple the password-slot table. The resolver in SignerOptionsFromCmdLine used two parallel arrays (String[][] slots + Consumer[] setters) coupled by index; reordering one without the other would have silently assigned a password to the wrong field. Replaced with a single List<PwdSlot> of records, which also lets the @SuppressWarnings("unchecked") go away.
2. Cover §3.5 of the design doc with tests. The design explicitly says a - coming from a properties file must not be reinterpreted as the stdin sentinel, and that a CLI -ksp - with the flag overrides a props-loaded value. Neither path had an assertion. Two integration tests added.
3. i18n for the "literal dash" warning. The warning emitted when - is given without --enable-stdin-passwords was hardcoded English. Moved to a new resource key console.stdinSentinelWarning (English bundle only — other locales follow via Weblate, per AGENTS.md). Also reworded so the literal value is no longer echoed back at the user.

Changes

• SignerOptionsFromCmdLine.java — record-based slot list; warning goes through RES.get(...).
• messages.properties — new console.stdinSentinelWarning key with {0} = option long name, {1} = flag long name.
• SignerOptionsFromCmdLineTest.java — two new tests:
  • dashFromPropertiesFile_isNotReinterpretedAsSentinel
  • cliSentinelOverridesPropertiesFileValue

Test plan

• mvn -pl jsignpdf test -Dtest=StdinPasswordReaderTest,SignerOptionsFromCmdLineTest — 25/25 green (17 in SignerOptionsFromCmdLineTest, including the two new ones; 8 in StdinPasswordReaderTest).