"Token has been expired" in Sulu remember-me authentication without built-in credential expiration management

Sulu delegates authentication to Symfony Security through the sulu_user provider and enforces least-privilege access using the sulu_security.role hierarchy and Symfony voters. When a remember-me token exceeds its configured lifetime, Symfony throws an AuthenticationException containing "Token has been expired", which Sulu propagates unchanged. However, core Sulu does not automatically enforce password expiration, and it lacks a built-in administrative interface to list, warn about, or reset expired credentials.

This absence leaves integrators to decide whether to implement password-age policies, token rotation, or custom listeners around the optional sulu_user.password_expired event. Without a centralized UI for monitoring credential state, compliance auditing and incident response become project-specific concerns. The framework surfaces expired remember-me tokens as a hard authentication failure but does not extend the same enforcement to password age or provide remediation tooling.

What is the intended architectural boundary between Sulu's framework responsibilities and project-specific credential lifecycle management? Should integrators treat Symfony-level remember-me expiration as the only credential-expiry signal, or is a custom password-age policy expected in least-privilege deployments? How can teams audit and remediate expired credentials when no built-in Sulu admin interface exists?