feat: read the lockout threshold and window in the password policy

The password change must stay below the domain's lockout threshold. The policy now carries lockout_threshold and lockout_window, from the domain or from the fine-grained policy that applies. AD-2's read allow-list names the new attributes.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3t4WL7bd9bdHHNjEsxzqC

portal/adapters/directory/base.py

@@ -33,6 +33,8 @@ POLICY_ATTRIBUTES = (
     "minPwdAge",
     "maxPwdAge",
     "lockoutDuration",
+    "lockoutThreshold",
+    "lockoutObservationWindow",
 )
 PSO_ATTRIBUTES = (
     "msDS-MinimumPasswordLength",
@@ -40,6 +42,8 @@ PSO_ATTRIBUTES = (
     "msDS-PasswordHistoryLength",
     "msDS-MinimumPasswordAge",
     "msDS-MaximumPasswordAge",
+    "msDS-LockoutThreshold",
+    "msDS-LockoutObservationWindow",
 )
 
 
@@ -96,6 +100,10 @@ class PasswordPolicy:
     max_age: timedelta | None  # None: passwords do not expire
     fine_grained: bool = False  # a fine-grained policy applies to the user
     fine_grained_readable: bool = True  # False: the values above are the domain's, not the user's
+    # Wrong passwords before AD locks the account; 0 means it never locks. Failed attempts are
+    # forgotten after the observation window (None: never forgotten).
+    lockout_threshold: int = 0
+    lockout_window: timedelta | None = None
 
 
 class Directory(Protocol):