fix(auth): only a session made since dismisses the owner's warning

The full reading's L1: the warning that ten wrong proofs ended a session is
there for the owner to learn of it, and any other session of the account
(another app on the same stolen phone) dismissed it. Now only a session
made after the warning dismisses it (signed in again, or the sign-in that
first shows it); an older one is refused (PasswordRefusal.signedInBefore,
its own text in English and German), and a new password clears it as
before. A member tells the register when its session asking was made.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_server/lib/src/register/account_register.dart

@@ -143,7 +143,11 @@ abstract interface class AccountRegister {
   Future<void> noteSessionEndedForProofs(Session session, UuidValue person);
 
   /// Dismisses [person]'s warning that a session was ended for its proofs.
-  Future<void> dismissSessionEndedWarning(Session session, UuidValue person);
+  Future<void> dismissSessionEndedWarning(
+    Session session,
+    UuidValue person, {
+    required DateTime? sessionMadeAt,
+  });
 
   /// Whether people sign in with a password and TOTP (ADR 0017): the
   /// register holds the keys it needs.