No way to see or clear a login lockout #529

An account locks after password.retrylimit failed logins and stays locked for password.lockoutperiod hours. An admin can't see it or undo it:

• The Administrator's user list and edit screens don't show it. GET /api/users/{userIdOrName} returns strikeCount and lastStrikeTime, but nothing in the client reads them.
• There's no unlock in the REST API, so the Administrator can't offer one. PUT /api/users/{userId} with strikeCount 0 returns 204 and changes nothing.
• Setting a new password doesn't clear it either.

Measured on PR #439's build with retrylimit = 30: after the lock, the new password and the PUT both returned 204, and two logins with the new password were still rejected as locked (strikeCount stayed at 31; an unlocked wrong password would have added a strike).

Raised by @tonygermano on PR #439: "Not a blocker for this PR, but should definitely be addressed".

Co-authored with Claude Code.