fix(auth): only a session made since dismisses the owner's warning

The full reading's L1: the warning that ten wrong proofs ended a session is
there for the owner to learn of it, and any other session of the account
(another app on the same stolen phone) dismissed it. Now only a session
made after the warning dismisses it (signed in again, or the sign-in that
first shows it); an older one is refused (PasswordRefusal.signedInBefore,
its own text in English and German), and a new password clears it as
before. A member tells the register when its session asking was made.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_server/lib/src/register/instance_api.dart

@@ -205,6 +205,8 @@ Future<Map<String, Object?>?> _answer(
       await register.dismissSessionEndedWarning(
         session,
         arguments.id('person'),
+        // When the member's session asking was made (the full reading's L1).
+        sessionMadeAt: arguments.optionalTime('sessionMadeAt'),
       );
       return const {};
     case RegisterOperation.deleteAccount:
@@ -521,6 +523,12 @@ extension type const _Arguments(Map<String, Object?> _map) {
   ByteData? optionalBytes(String name) =>
       optionalString(name) == null ? null : bytes(name);
 
+  /// The moment [name] (ISO 8601) in UTC; null where it is missing.
+  DateTime? optionalTime(String name) => switch (optionalString(name)) {
+    final value? => DateTime.parse(value).toUtc(),
+    null => null,
+  };
+
   /// Whether the argument [name] holds anything (not null).
   bool has(String name) => _map[name] != null;