Spike: Investigate `passcode` Flag Behavior for Affiliated Companies

### Objectives
1. Confirm why already-affiliated companies can still display the “use company password” option.
2. check affiliation and migration path that should set passcode flag
3. Determine whether this is a code defect, a migration-data gap, or both.

### Outcome
- Documented investigation findings.
- List of affected scenarios and, if feasible, affected production records.

### Assumptions
- Once a company is affiliated, the legacy company-password option should no longer be available.

No files, tests, or entry points are named. Start by tracing the affiliation and migration path that sets the passcode flag, then compare the observed behavior with the assumption that affiliated companies cannot use the legacy password option. Done means documented findings, affected scenarios, and, if feasible, affected production records.

Written by the indexing model from the issue text.