feat(access): add guarded local password lifecycle and recovery

tests/test_automation_principal.py

@@ -29,6 +29,7 @@ from govoplan_core.tenancy.scope import (
     create_scope_tables,
     scope_registry,
 )
+from govoplan_core.settings import settings
 
 
 class AutomationPrincipalTests(unittest.TestCase):
@@ -189,6 +190,14 @@ class AutomationPrincipalTests(unittest.TestCase):
             suspended.provenance["status"],
         )
 
+    def test_required_local_password_change_denies_delegated_automation(self) -> None:
+        self.account.password_reset_required = True
+        self.session.commit()
+        with patch.object(settings, "auth_local_password_recovery_enabled", True):
+            result = self.provider.resolve_automation_principal(self.session, request=self._request())
+        self.assertFalse(result.allowed)
+        self.assertEqual("password_change_required", result.provenance["status"])
+
     def test_service_account_resolution_uses_current_scope_ceiling(self) -> None:
         account = Account(
             id="service-account-backing",