fix(auth): only a session made since dismisses the owner's warning

The full reading's L1: the warning that ten wrong proofs ended a session is
there for the owner to learn of it, and any other session of the account
(another app on the same stolen phone) dismissed it. Now only a session
made after the warning dismisses it (signed in again, or the sign-in that
first shows it); an older one is refused (PasswordRefusal.signedInBefore,
its own text in English and German), and a new password clears it as
before. A member tells the register when its session asking was made.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_client/lib/src/protocol/password/password_refusal.dart

@@ -93,7 +93,13 @@ enum PasswordRefusal implements _isc.SerializableModel {
   /// A first password for an account that signs in with GitHub alone takes
   /// a GitHub sign-in of the last 10 minutes (the fourth reading: a session
   /// alone sets none): sign in with GitHub again, then set it.
-  signInAgain;
+  signInAgain,
+
+  /// The warning that a session of the account was ended for its wrong
+  /// proofs is dismissed only by a session made since (the full reading's
+  /// L1: another session of a stolen device would dismiss its only use):
+  /// sign in again on this device, or change the password.
+  signedInBefore;
 
   static PasswordRefusal fromJson(String name) {
     switch (name) {
@@ -139,6 +145,8 @@ enum PasswordRefusal implements _isc.SerializableModel {
         return PasswordRefusal.passwordChanged;
       case 'signInAgain':
         return PasswordRefusal.signInAgain;
+      case 'signedInBefore':
+        return PasswordRefusal.signedInBefore;
       default:
         throw ArgumentError(
           'Value "$name" cannot be converted to "PasswordRefusal"',