authelia: allow password reset writes

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/guildhall-join-check.py

@@ -1,5 +1,6 @@
-"""Self-check for guildhall-join.py: invites, the append-only users file, and
-that Authelia accepts the password hashes it writes.
+"""Self-check for guildhall-join.py: invites, the append-only users file (also
+after Authelia rewrote it for a password reset), and that Authelia accepts the
+password hashes it writes.
 
 Run it against the same python the service uses, with authelia on PATH:
 
@@ -78,6 +79,23 @@ check("display name survives quoting", users["alex"]["displayname"] == 'Alex "th
 check("invite is spent", j.open_invite(token) is None)
 check("spent invite refused", refused(j.sign_up, token, "sam", "", "longpassword", "longpassword"))
 
+# What Authelia's yaml writer leaves behind after a password reset.
+REWRITTEN = """users:
+    fred:
+        password: $argon2id$v=19$m=65536,t=3,p=4$c2FsdA$aGFzaA
+        displayname: Fred
+        email: fred@example.org
+        groups:
+            - household
+        address: null
+        extra: {}
+"""
+j.USERS_FILE.write_text(REWRITTEN)
+second = j.mint("after a reset")
+j.sign_up(second, "sam", "", "correct horse battery", "correct horse battery")
+rewritten = yaml.safe_load(j.USERS_FILE.read_text())["users"]
+check("signs up after authelia rewrote the file", set(rewritten) == {"fred", "sam"} and rewritten["sam"]["groups"] == ["guildhall"])
+
 expired = j.mint("old", now=1.0)
 check("expired invite is closed", j.open_invite(expired) is None)