Document demo installer password checks vs REST API settings #4081

DEVELOPER_GUIDE.md

@@ -174,6 +174,8 @@ export OPENSEARCH_INITIAL_ADMIN_PASSWORD=<password>
 
 **_Note:_** If no password is supplied, the installation will fail. The password supplied will also be tested for its strength and will be blocked if it is too simple. There is an option to skip this password validation by passing the `-t` option to the installation script. However, this should only be used for test environments.
 
+The demo installer does not read `plugins.security.restapi.password_min_length` or `plugins.security.restapi.password_validation_regex` from `opensearch.yml`. Those settings apply later, when you create or update users through the REST API or OpenSearch Dashboards. The installer runs before the node loads cluster settings, so it uses its own checks: at least 8 characters, one uppercase letter, one lowercase letter, one digit, one special character, and a strong zxcvbn score. Changing the REST API password settings does not change what the demo script accepts for `OPENSEARCH_INITIAL_ADMIN_PASSWORD`.
+
 
 ### Executing the demo installation script
 

src/main/java/org/opensearch/security/tools/democonfig/SecuritySettingsConfigurer.java

@@ -191,6 +191,8 @@ void updateAdminPassword() throws IOException {
         }
 
         try {
+            // Demo-only rules. Not plugins.security.restapi.password_* from opensearch.yml —
+            // this installer runs before those cluster settings are loaded.
             final PasswordValidator passwordValidator = PasswordValidator.of(
                 Settings.builder()
                     .put(