fix: harden password change after code review

Count and audit a wrong current password found at change time, log the unclear outcome with its details and end the other sessions as far as possible, note a lockout threshold of 1 in the audit, skip the local hints when the fine-grained policy cannot be read, round the minimum age up, reset the form after back navigation, give error messages unique ids, and fix the German rejection text. Adds tests for the block length, the masked password fields and the new cases; the review findings are recorded in the plan and the deferred work.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FocPJ75XPma7TcuYEMy8zm

_bmad-output/initiative-ping-mee-portal/deferred-work.md

@@ -1,3 +1,21 @@
 - source_plan: `_bmad-output/initiative-ping-mee-portal/epic-platform-and-sign-in/story-audit-throttle-and-session-foundations-plan.md`
   summary: Concurrent writers on the throttle counters are not tested.
   evidence: The test database is SQLite in memory with a shared cache, which answers "table is locked" to a second writer at once, so a threaded test fails for reasons that say nothing about production (a WAL file database with a 20 s busy timeout and IMMEDIATE transactions). A real test needs a file database; tried and dropped in the refactor sweep.
+- source_plan: `_bmad-output/initiative-ping-mee-portal/epic-account-self-service/story-password-change-plan.md`
+  summary: Code review 2026-10-19: the throttle check and the failure count are separate steps, so parallel requests can all pass the check before any failure is counted and more wrong binds reach AD than the limit allows.
+  evidence: Pre-existing design of the throttle foundation (AD-7); `portal/accounts/throttle.py` `check` and `hit`. Needs a reserve-then-confirm step to fix, for every endpoint at once.
+- source_plan: `_bmad-output/initiative-ping-mee-portal/epic-account-self-service/story-password-change-plan.md`
+  summary: Code review 2026-10-19 (unverified, would be medium): a timeout after AD applied the password change is reported as "nothing changed", so sessions are not ended and no mail is queued.
+  evidence: Settle by checking whether `LdapDirectory._service` / `modify_s` turns a lost response into `DirectoryUnavailable`, and whether `verify_password` with the new password after a timeout would tell.
+- source_plan: `_bmad-output/initiative-ping-mee-portal/epic-account-self-service/story-password-change-plan.md`
+  summary: Code review 2026-10-19: no signed-in page sends `Cache-Control: no-store`, so the back button can show a page after sign-out.
+  evidence: Pre-existing; only the health check uses `never_cache`. Decide once for every authenticated page (middleware), not per page.
+- source_plan: `_bmad-output/initiative-ping-mee-portal/epic-account-self-service/story-password-change-plan.md`
+  summary: Code review 2026-10-19: AD-2 in the architecture spine names a `msDS-Lockout*` wildcard, but the adapter reads only `msDS-LockoutThreshold` and `msDS-LockoutObservationWindow`.
+  evidence: Fix edits the architecture document; reword AD-2 to name the two attributes.
+- source_plan: `_bmad-output/initiative-ping-mee-portal/epic-account-self-service/story-password-change-plan.md`
+  summary: Known limitation, accepted in the code review of 2026-10-19: when AD never forgets failed attempts (a lockout observation window of 0), the portal's pause is still 15 minutes, so its limit does not keep up with AD's count.
+  evidence: Unusual AD setup; not the owner's. Revisit if a deployment sets the observation window to never.
+- source_plan: `_bmad-output/initiative-ping-mee-portal/epic-account-self-service/story-password-change-plan.md`
+  summary: Known limitation, accepted in the code review of 2026-10-19: failed binds made elsewhere (authentik, other devices) count toward AD's lockout but not toward the portal's limit.
+  evidence: Already stated in the plan's design notes. Fixing it needs a new directory read of the bad-password count (new adapter surface).

_bmad-output/initiative-ping-mee-portal/epic-account-self-service/story-password-change-plan.md

@@ -110,3 +110,41 @@ context:
 - The mail is rendered once at queue time with the change time in the display zone; the body is removed from the database after sending (see the outbox).
 - Not verified: the real directory (the done checkpoint below) and the browser look of the new form, spinner and error summary.
 - Not covered by a test: a double submit from two tabs at once (the second attempt fails as a wrong current password, which is harmless).
+
+### Review Findings
+
+Code review of `ead5670..49c7fd4` on 2026-10-19 (blind hunter, edge case hunter, verification gap, acceptance auditor).
+
+- [x] [Review][Decision] Unreadable fine-grained policy: the attempt limit, the pause and the local hints use the domain values — a stricter policy can lock the account before the portal blocks; a looser one can be refused by the local hints [portal/profile/services.py:148] — resolved: the local hints are skipped when the policy cannot be read; the limit keeps the domain threshold minus one (never below 1)
+- [x] [Review][Decision] Lockout window "never forgotten" (`lockout_window=None`): the pause falls back to 15 minutes while AD keeps counting, so the limit protects nothing [portal/profile/services.py:156] — resolved: kept as a known limitation (unusual AD setup), recorded in deferred-work.md
+- [x] [Review][Decision] Failed binds made elsewhere (authentik, other devices) count toward AD's lockout but not toward the portal's limit; the design notes accept this, a fix needs a new directory read [portal/profile/services.py:148] — resolved: accepted, recorded in deferred-work.md
+- [x] [Review][Decision] Unclear outcome (AD changed, portal did not commit): the user's other sessions stay alive and no failure entry is written; a test asserts the sessions stay [portal/profile/services.py:231] — resolved: the other sessions are ended and a failure entry is written on a best-effort basis
+- [x] [Review][Patch] Wrong current password found at change time (race) is neither counted toward the limit nor audited [portal/profile/services.py:224]
+- [x] [Review][Patch] The error log for a failure after the AD call has no change details (AD-4 asks for them: user, IP, time, step, exception) [portal/profile/services.py:234]
+- [x] [Review][Patch] Lockout threshold 1 is not noted in the audit, as the design notes require [portal/profile/services.py:148]
+- [x] [Review][Patch] No test checks how long the block lasts (`blocked_until` about the observation window); `test_the_pause_is_over_after_the_lockout_window` clears the block by hand and is misnamed [portal/tests/test_password_change.py]
+- [x] [Review][Patch] No test checks that `sensitive_post_parameters` masks all three password fields [portal/profile/views.py:50]
+- [x] [Review][Patch] Back-navigation restores the page from the back/forward cache with a disabled button and a running spinner [portal/static/portal/shell.js:53]
+- [x] [Review][Patch] Several errors on one field repeat the same element id and `aria-describedby` points to only one of them [portal/templates/profile/_field.html:6]
+- [x] [Review][Patch] `maxlength="256"` is hard-coded in the field template instead of coming from the form [portal/templates/profile/_field.html:5]
+- [x] [Review][Patch] German formal text "kommt zu kurz nach der letzten Änderung" reads as "too short"; it means "changed too recently" [portal/locale/de/LC_MESSAGES/django.po:163]
+- [x] [Review][Patch] The minimum age is rounded down (1.4 days shows as 1 day) and a minimum length of 0 shows "At least 0 characters" [portal/profile/services.py:63]
+- [x] [Review][Defer] Throttle check and failure count are separate steps, so parallel requests can all pass the check before any is counted [portal/accounts/throttle.py:39] — deferred: pre-existing design of the throttle foundation (AD-7), not changed by this ticket
+- [x] [Review][Defer] A timeout after AD applied the change is reported as "nothing changed" (sessions and mail skipped) [portal/profile/services.py:228] — deferred: unverified medium; settle by checking whether the adapter turns a lost response after `modify_s` into `DirectoryUnavailable`
+- [x] [Review][Defer] Authenticated pages carry no `Cache-Control: no-store`, so the back button can show a page after sign-out [portal/config/settings.py] — deferred: pre-existing, applies to every signed-in page; decide once for the whole portal
+- [x] [Review][Defer] AD-2 in the spine names a `msDS-Lockout*` wildcard while the code reads two attributes [ARCHITECTURE-SPINE.md] — deferred: the fix edits the architecture document
+
+#### Rejected
+
+- Invalid form while throttled re-reads the policy from AD (low): unlikely, and the fix adds a branch for no user harm; no password is checked.
+- 429 page shows no form (false): the spec asks only for the message and status 429.
+- "Please wait a few minutes" can be shorter than the real pause (reject): the message text is prescribed by the spec.
+- Extra rule "No part of your user name or display name" (low): accurate for AD complexity, no harm.
+- Invalid form with the directory down shows no notice (low): unlikely, fix adds a branch.
+- User deleted mid-request gives a bare 500 (low): not reachable in normal use, fix adds a branch.
+- Submit handler ignores `defaultPrevented` (false): no other submit listener exists in `shell.js`.
+- Spinner has no accessible text, reduced-motion only slows it (low): cosmetic.
+- German "klappt", "Administration" vs "Admin", singular wording of the history rule (low): cosmetic.
+- Rules shown above the fields, "Result unclear" page added (false): disclosed judgement calls that meet the first acceptance criterion and the "outcome unknown" criterion.
+- Plan task boxes unticked, `tickets.toml` header miscount, plan notes wording (reject): fix edits the spec or planning documents.
+- No JavaScript tests (reject): no JS test setup exists; the plan lists the browser look as not verified.