fix arguable off-by-one in password expiry check

Old behaviour was to allow upto and including the expiry day, but this changes
it to allow upto but _not_ including which apparently matches some other tools
and libraries (e.g. Linux-PAM pam_unix.so).

Anthropic ANT-2026-V1VNLWUV

auth-shadow.c

@@ -44,8 +44,9 @@
 extern struct sshbuf *loginmsg;
 
 /*
- * For the account and password expiration functions, we assume the expiry
- * occurs the day after the day specified.
+ * For the password expiration function, we assume the expiry occurs the
+ * day after the day specified.  An account is expired from the day given
+ * by sp_expire onward, matching chage(1), login(1) and pam_unix(8).
  */
 
 /*
@@ -66,7 +67,7 @@ auth_shadow_acctexpired(struct spwd *spw)
 
 	if (spw->sp_expire == -1) {
 		debug3("account expiration disabled");
-	} else if (daysleft < 0) {
+	} else if (daysleft <= 0) {
 		logit("Account %.100s has expired", spw->sp_namp);
 		return 1;
 	} else if (daysleft <= spw->sp_warn) {