NixOS users.users attribute missing passwordExpiry for credential lifecycle management

NixOS users.users. provides declarative configuration for home directories, shells, and group membership, but does not expose a passwordExpiry attribute. This creates a mismatch between declared system state and the actual /etc/shadow expiry field, requiring administrators to manage credential lifecycle through external PAM modules or ad hoc scripts. The absence of a built‑in option means that password expiry policies are not version‑controlled alongside the Nix expression, and upgrade paths may silently preserve or reset shadow settings depending on the release series. Additionally, removing a user from the NixOS configuration does not automatically purge the corresponding system user, potentially leaving orphaned accounts with unchanged password policies.

Current NixOS releases vary in how they handle shadow file persistence during configuration rebuilds, and no official option guarantees consistent exp field behavior across versions. Administrators relying on PAM for expiry reporting face the risk of policy conflicts that could lock out users if password aging rules contradict the system's declarative intent. These uncertainties complicate auditing and automated compliance checks for credential rotation schedules.

What mechanisms can NixOS provide to declaratively set or reset the /etc/shadow exp field for system users? How should password expiry policies be version‑controlled and propagated through the Nix store without manual intervention? Is there a recommended approach for auditing and reconciling existing shadow entries against the declared user configuration?