feat: read the lockout threshold and window in the password policy

The password change must stay below the domain's lockout threshold. The policy now carries lockout_threshold and lockout_window, from the domain or from the fine-grained policy that applies. AD-2's read allow-list names the new attributes.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3t4WL7bd9bdHHNjEsxzqC

portal/adapters/directory/fake.py

@@ -29,6 +29,8 @@ DEFAULT_POLICY = PasswordPolicy(
     history_length=24,
     min_age=timedelta(0),
     max_age=timedelta(days=90),
+    lockout_threshold=5,
+    lockout_window=timedelta(minutes=30),
 )