TYPO3 backend password lifetime not enforced for LDAP-authenticated users

We run TYPO3 (v12 LTS) with backend users split between internal accounts and accounts synchronized from LDAP. The Install Tool setting [FE][loginSecurity][password_lifetime] is configured to force periodic password changes, and internally authenticated users are correctly redirected to the password change form when their credentials expire.

Our goal is least-privilege, policy-compliant authentication: every backend account should be subject to a credential expiration boundary, regardless of which authentication service validates the login. From what we can tell, the password lifetime setting and the expiration timestamp appear to be evaluated only by the internal authentication service, so LDAP-authenticated users never see a forced password change at the TYPO3 level.

This leaves a gap in our design: should expiration be enforced by TYPO3, by the directory, or both?

Specifically:

1. Is the password lifetime setting intentionally scoped to the internal authentication service only, or should it also apply to externally authenticated backend users?
2. Can LDAP synchronization overwrite the password expiration fields on the user record after each sync, and how do we verify this?
3. If enforcement must happen in the directory, what is the recommended way to confirm the LDAP policy actually governs TYPO3 logins?