How can Forgejo be configured to enforce least-privilege authentication while rejecting expired credentials?

When running a Forgejo instance that authenticates users against an external LDAP directory, administrators often aim to apply the principle of least privilege by granting only the permissions required for each role. At the same time, they need to ensure that user accounts whose LDAP passwords have expired are not allowed to log in, even if the account still exists in the directory. The Forgejo documentation mentions support for LDAP synchronization and authentication filters, but it is unclear whether expired credentials can be automatically rejected without manual intervention. How can Forgejo be configured to enforce least‑privilege access while automatically blocking login attempts that use expired LDAP credentials, and what configuration options or hooks are available to achieve this behavior?