Admin password timeout compares client and server clocks instead of server and server

When checking the timeout for certain admin actions like creating a user or adding an app, it seems that NextCloud compares the last authentication time on the server against the client's current time. If the server and client clocks are not synchronized and are off by more than the timeout, it is impossible to authenticate because the server always sees the new authentication as happening too long ago already. Of course, it is good practice to keep clocks synchronized any way, but NextCloud should compare two times on the server, not one on the server and one on the client. Otherwise, the timeout could be bypassed by someone setting the client's clock back.

If you need more information, see #2734 which I created for this problem. It was opened with a generic title about password authentication and then closed with a fix for an LDAP problem that was identified, but this is a separate password authentication problem from that.

The issue does not name a file or test. Trace the admin-action password-timeout handling, starting with the code that records and checks the last authentication time. Reproduce the failure with client and server clocks offset, then verify that the timeout is based on two server-side timestamps and that the existing authentication tests cover the behavior.