Force password change at next logon, including the AD flag 773 case

## What

“must change password at next logon”: #5889 is the AD flag 773 case; #19681 is the generic admin force-reset. Same user-facing feature.

## Want

- “must change password at next logon”: #5889 is the AD flag 773 case
- #19681 is the generic admin force-reset

## Ideas this came from

- [#5889 Allow Resetting of User Password When AD flag "user must change password at next logon" is set](https://github.com/goauthentik/authentik/issues/5889) — Allow LDAP expired/admin-set password to be changed in Authentik UI by parsing LDAP error code 49 sub-message 773. If the error code 49 has the sub-code 773 it
- [#19681 Force password reset on next login](https://github.com/goauthentik/authentik/issues/19681) — Allow admins to force a user to reset password on next login. Similar to AD functionality on reset password dialog

Start by reading linked issues #5889 and #19681 to compare the AD flag 773 and generic admin force-reset cases. Define done as supporting both “must change password at next logon” paths in the user-facing login flow; this issue names no files or tests, so repository exploration is required.

Written by the indexing model from the issue text.