[Bug]: Password change workflow

### ⚠️ Before submitting, please verify the following: ⚠️

- [x] This is a **bug**, not a question or a configuration issue.
- [x] This issue is **not** already reported on Github (I've searched it).
- [x] Nextcloud Server and Desktop Client are **up to date**. See [Server Maintenance and Release Schedule](https://github.com/nextcloud/server/wiki/Maintenance-and-Release-Schedule) and [Desktop Releases](https://nextcloud.com/install/#install-clients) for supported versions.
- [x] I agree to follow Nextcloud's [Code of Conduct](https://nextcloud.com/contribute/code-of-conduct/)

### Bug description

After changing my Nextcloud password in the web interface, my account has been locked and my IP throttled. This is because I have 3 systems connecting to my Nextcloud account that still use on the old password: two Linux desktops (Nextcloud clients and Thunderbird calendars) and one Android (Nextcloud client, davx5, Notes, Tasks, Talk). All these applications got their credentials by logging in and granting them access (as this is the most obvious way to do it when configuring them). As they automatically connect, they fails to login, triggered the brute force protection mechanism.

### Steps to reproduce

1. Change your user password in the web interface of Nextcloud
2. Wait until your Nextcloud-connected applications fail to connect and lead your account to get disabled within a few minutes

### Expected behavior

I could imagine several improvements to the password change workflow:
1. recommend within Nextcloud client applications to rely on app passwords instead of logging in and granting access. But then the applications should have an easy way to scan the generated app password and not expect the end user to type in long random passwords.
2. have the client applications clearly notify the user that login was denied and offer a way to re-generate the access credentials, without having to delete all local files or the local configuration (yes, I had to re-upload Gb of pictures after deleting the Android Nextcloud client).
3. ideally allow the user to define a grace period after a password change when the old password would still be accepted and all applications / IPs connecting using the old password would be logged and show to the user (so it is easier to spot which applications must still be updated)

### Which files are affected by this bug

/remote.php/dav/files

### Operating system

Other (e.g. FreeBSD)

### Which version of the operating system you are running.

Android 15 - Ubuntu 24.04

### Package

Official PPA

### Nextcloud Server version

31.0.7

### Nextcloud Desktop Client version

3.11.0

### Is this bug present after an update or on a fresh install?

Updated from a minor version (ex. 3.16.1 to 3.16.2)

### Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

### Are you using an external user-backend?

- [x] Default internal user-backend
- [ ] LDAP/ Active Directory
- [ ] SSO - SAML
- [ ] Other

### Nextcloud Server logs

```shell
{"reqId":"aRer6Y-JuFdkyPzZNfyBHgAAAAo","level":2,"time":"2025-11-14T22:24:04+00:00","remoteAddr":"192.168.1.22","user":"--","app":"core","method":"GET","url":"/ocs/v2.php/apps/notifications/api/v2/notifications?format=json","message":"Login failed: 'XXXXX' (Remote IP: '192.168.1.22')","userAgent":"Mozilla/5.0 (Linux) mirall/3.11.0git (Nextcloud, ubuntu-6.8.0-87-generic ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"31.0.7.1","clientReqId":"e7b0c8f9-d3d2-4410-988b-ddafd6d93815","data":{"app":"core"}}
{"reqId":"aRer6W_MTUhIZlcJucIHKQAAAAQ","level":2,"time":"2025-11-14T22:24:04+00:00","remoteAddr":"192.168.1.22","user":"--","app":"core","method":"GET","url":"/ocs/v2.php/apps/user_status/api/v1/user_status?format=json","message":"Login failed: 'XXXXX' (Remote IP: '192.168.1.22')","userAgent":"Mozilla/5.0 (Linux) mirall/3.11.0git (Nextcloud, ubuntu-6.8.0-87-generic ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"31.0.7.1","clientReqId":"0ef3c825-f03b-42de-9cd9-a2b9ec4e35c7","data":{"app":"core"}}
```

### Additional info

_No response_