fix(auth): only a session made since dismisses the owner's warning

The full reading's L1: the warning that ten wrong proofs ended a session is
there for the owner to learn of it, and any other session of the account
(another app on the same stolen phone) dismissed it. Now only a session
made after the warning dismisses it (signed in again, or the sign-in that
first shows it); an older one is refused (PasswordRefusal.signedInBefore,
its own text in English and German), and a new password clears it as
before. A member tells the register when its session asking was made.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_server/test/integration/register/member_test.dart

@@ -48,6 +48,9 @@ final class _Register implements AccountRegister {
   /// member's made just now.
   final freshGitHubSignIns = <UuidValue>{};
 
+  /// When the session dismissing a warning was made, by person.
+  final dismissedMadeAt = <UuidValue, DateTime?>{};
+
   /// Those [setPassword] was told are anonymous on the member.
   final anonymousHere_ = <UuidValue>{};
 
@@ -226,10 +229,14 @@ final class _Register implements AccountRegister {
   }
 
   @override
-  Future<void> dismissSessionEndedWarning(Session session, UuidValue person) =>
-      _answer('dismissSessionEndedWarning', () {
-        dismissed.add(person);
-      });
+  Future<void> dismissSessionEndedWarning(
+    Session session,
+    UuidValue person, {
+    required DateTime? sessionMadeAt,
+  }) => _answer('dismissSessionEndedWarning', () {
+    dismissed.add(person);
+    dismissedMadeAt[person] = sessionMadeAt;
+  });
 
   @override
   Future<bool> passwordSignInOffered(Session session) =>
@@ -1337,6 +1344,8 @@ void main() {
             "never another's", () async {
           await endpoints.password.dismissSessionEndedWarning(asBen());
           expect(register.dismissed, {ben});
+          // With when Ben's session here was made (the full reading's L1).
+          expect(register.dismissedMadeAt[ben], isNotNull);
           await expectLater(
             endpoints.password.dismissSessionEndedWarning(
               sessionBuilder.copyWith(