Why doesn't Citadel have the ability to enforce password strength?

Because your idea of a "strong" password is completely wrong.