Fixed unreleased bug where admin password was still shown on a wiped
host after re-enrollment.
Add a `deleted` column and soft-delete the row on re-enrollment,
mirroring host_recovery_key_passwords.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43488
# Checklist for submitter
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **New Features**
* Added support for safely retiring managed local account passwords
during device re-enrollment.
* Retired credentials are excluded from retrieval, status updates,
command operations, and automatic rotation.
* Successfully escrowing a password can restore a previously retired
record.
* **Bug Fixes**
* Re-enrollment cleanup now clears stale password rotation state.
* Cleanup failures stop reset or re-enrollment processing to prevent
incomplete credential changes.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Victor Lyuboslavsky
3d186bd172