feat: advance login workflow and integration gates

crates/latchd-core/src/config.rs

@@ -72,6 +72,8 @@ pub struct AccountsConfig {
     pub faillock_path: PathBuf,
     /// faillock configuration used to read the deny threshold.
     pub faillock_config: PathBuf,
+    /// Shadow database used for local password and account aging checks.
+    pub shadow_path: PathBuf,
 }
 
 impl Default for AccountsConfig {
@@ -82,6 +84,7 @@ impl Default for AccountsConfig {
             enumerate: true,
             faillock_path: PathBuf::from("/usr/sbin/faillock"),
             faillock_config: PathBuf::from("/etc/security/faillock.conf"),
+            shadow_path: PathBuf::from("/etc/shadow"),
         }
     }
 }
@@ -293,6 +296,7 @@ pub fn validate(config: &Config) -> Result<(), Error> {
         ("x11.server_log_path", &config.x11.server_log_path),
         ("accounts.faillock_path", &config.accounts.faillock_path),
         ("accounts.faillock_config", &config.accounts.faillock_config),
+        ("accounts.shadow_path", &config.accounts.shadow_path),
     ] {
         if !path.is_absolute() {
             return Err(Error::Config(format!("{name} must be an absolute path")));