mod_dav_svn returns generic 401 for expired LDAP passwords with no way to distinguish them from bad credentials

Goal

I want a Subversion repository served by Apache httpd with mod_dav_svn and LDAP authentication to handle expired passwords in a predictable, least-privilege way: once a user's LDAP password expires, access should stop immediately and the failure should be identifiable as an expiration rather than a wrong password.

Constraints and uncertainty

From what I can tell, mod_dav_svn surfaces an expired LDAP bind as a plain HTTP 401 with no distinguishing error body, so clients and administrators cannot tell expiration apart from malformed credentials without reading external LDAP logs. Separately, the Subversion client's credential cache (under ~/.subversion/auth/) may keep a previously successful authentication alive, meaning path-based authz rules continue to be evaluated against a stale identity until the cache is cleared or expires. This leaves a window where least-privilege controls appear effective but are not.

Assume a recent Subversion 1.14.x server with mod_dav_svn and mod_authnz_ldap; behavior may differ for svnserve with SASL, which I am not using.

Questions

1. Is there any supported mod_dav_svn or Apache configuration that makes an expired LDAP password produce a distinguishable response instead of a generic 401?
2. Can the server force re-evaluation of authz rules when the underlying LDAP credential expires, or is the client-side auth cache entirely outside server control?
3. What is the recommended way to verify, per access method, that expired credentials actually block access rather than being masked by cached authentication?