Answer
Check whether the IFSCONNECT application user's own status is Active — in a confirmed case, this exact 401 error had nothing to do with the password change itself; the actual cause was that the IFSCONNECT user had an Inactive status in the application. Setting the IFSCONNECT user's status to Active resolved the UnauthorizedAccessException completely, even though the password, instance, and service-level troubleshooting had all been correct and thorough. This is worth checking early, since it's easy to overlook while focused on password/credentials troubleshooting.