Entra password flow silently overwrites existing local password, breaking GNOME Keyring auto-unlock

When a user logs in with the Entra password + MFA flow and a local password already exists, the broker unconditionally replaces the local password with the Entra password and shows *"Your local password has been set to your Entra password"*. No `PAM_OLDAUTHTOK` is provided, so `pam_gnome_keyring` cannot re-key the default keyring. If the Entra password differs from the old local password, the keyring will no longer auto-unlock.

## Steps to reproduce

1. Log in with device auth and set a local password `P1`. The GNOME Keyring is now keyed to `P1`.
2. Log out, then log in with the Entra password + MFA flow.
3. The local password is silently replaced with the Entra password `E1` (if `E1 ≠ P1`).
4. On subsequent logins, the GNOME Keyring no longer auto-unlocks because `PAM_AUTHTOK` is `E1` but the keyring was keyed to `P1`.

## Proposed behaviour

When the Entra password + MFA flow succeeds **and a local password already exists**:

1. Ask the user: *"Update your local password to your Entra password?"*
2. **If yes:** prompt for the current local password (to enable keyring re-keying via `PAM_OLDAUTHTOK`), store the Entra password as the new local password, and return the old password as `PAM_OLDAUTHTOK` alongside the new one as `PAM_AUTHTOK`.
3. **If no (or old password skipped):** keep the existing local password unchanged.

When **no local password exists yet**, the current behaviour (silently set the Entra password as the local password) is correct and should be preserved.

## Related

- #369
- #1682

Trace the broker's Entra password + MFA flow and inspect how it handles an existing local password and PAM_AUTHTOK/PAM_OLDAUTHTOK. Verify the current behavior when a local password exists versus when none exists. Done means the user can choose whether to update the password, the old password is available for re-keying when supplied, and the no-local-password behavior remains unchanged.

Written by the indexing model from the issue text.