Local password login fails when refreshed token can't be verified

### Problem

When unlocking the screen with a local password, login fails if the refreshed token cannot be verified, even when `force_access_check_with_provider` is disabled.

For example, an incorrect system clock can make the token appear expired. The logs show:

> Failed to refresh token: access token verification failed: token expired at 1787574647 (now: 1787575275)

### Expected behavior

- If `force_access_check_with_provider = false` (the default), a valid local password authenticates the user unless the token refresh clearly indicates that the user should not have access anymore (e.g. when the user or device was disabled).
- If `force_access_check_with_provider = true`, local password authentication requires a successful token refresh; any token refresh failure denies login.

Start by tracing the local password login flow and how it handles refreshed-token verification, with particular attention to the force_access_check_with_provider setting. Compare behavior for token-refresh failures when the setting is false versus true; done means valid local-password login is preserved in the first case unless access is clearly revoked, while every refresh failure denies login in the second.

Written by the indexing model from the issue text.