Finally I found issue. The key for validation rules and messages are the field ids not their types. So for my example ‘user_password’ instead of ‘password’ the validation array should look like this:
'validation' => array(
'rules' => array(
"user_password" => array(
'required' => true,
'minlength' => 7,
),
),
// optional override of default jquery.validate messages
'messages' => array(
"user_password" => array(
'required' => __( 'Password is required', 'meta-box' ),
'minlength' => __( 'Password must be at least 7 characters', 'meta-box' ),
),
)
)