feat: handle PAM password policy changes

crates/latchd-core/src/error.rs

@@ -47,6 +47,21 @@ pub enum Error {
     Worker(String),
 }
 
+impl Error {
+    /// Returns a PAM status when this error came directly from PAM.
+    pub fn pam_status(&self) -> Option<i32> {
+        match self {
+            Self::Pam { status, .. } => Some(*status),
+            _ => None,
+        }
+    }
+
+    /// Returns whether PAM requires a password change before login can finish.
+    pub fn requires_password_change(&self) -> bool {
+        matches!(self.pam_status(), Some(12 | 27))
+    }
+}
+
 /// Adds a stable operation label to an I/O error.
 pub fn io_error(context: impl Into<String>, source: io::Error) -> Error {
     Error::Io {