#474 feat(doctor): report optional password enrollment

[Anonymous]

Originally created by: slegarraga

Closes [#439]

What

• Adds a read-only Password doctor check beside 2FA.
• Reports OK when the local password factor is enrolled and a non-critical warning with setup guidance when it is not.
• Uses the existing password.is_enrolled() presence check; it never reads or exposes the secret.

Tests

• Unit coverage for enrolled and missing states.
• Ordering coverage that Password appears immediately after 2FA.
• JSON output coverage for both states.

Verification

• .venv/bin/pytest tests/unit -k doctor — 23 passed, 1 skipped.
• .venv/bin/pytest tests/unit/test_cli_doctor.py tests/unit/test_cli_doctor_json.py — 21 passed.
• .venv/bin/ruff check and .venv/bin/ruff format --check pass on changed files.

[Anonymous]

Ticket changed by: fu351

• status: open --> closed

[Anonymous]

Ticket changed by: fu351

• status: closed --> open

[Anonymous]

Ticket changed by: fu351

• status: open --> closed

[Anonymous]

Originally posted by: fu351

Merged, thanks @slegarraga! Mirroring _check_2fa line for line, a warning rather than a failure, is the right posture for an optional factor, and the ordering test that pins Password right after 2FA goes red the moment someone reorders the list.