No logout solution: the logout button brings you to the login screen but does not invalidate the token, so login is possible again with no password input. This will make you support the person once every 2 months.

Automated support: give him a robocall center to call to reset his password via phone.

And than that got me thinking, if the person is more comfortable with phones rather than computers, why not a login with the phone? Input SMS code to complete the login (I know I know SMS are not the best, but it might be a good compromise here). Or something else like scan a QR code.

In the end the password is just a mechanism to "prove the identity". If you can prove that a connection is from the authorized person with another method that is not memory, or memory of a different kind (pattern memory? Probably too simple for a web exposed endpoint) that will probably work too.

Alas, if you don't have a budget for implementing passkeys I'm afraid these are more thought exercises than practical solutions....

Anyway, cheers

And the error message is "Wrong username or password. Try again."

I've got some (though not much) experience implementing them if there are questions

In terms of covering your own ass maybe just gathe data about invalid with attempts and try to pitch your customer on having some internal IT training. Also if they're that bad remember you can "fire" customers

Self-service password resets already exist.

Sessions last over 60 days but he seems to log out all the time.

Finally using the browser storage for a password hint or the password itself; like a session cookie with no expiration date.

One could also use a technique like JWT tokens in apps, which continuously renew themselves without a need for a password.