fix(auth): a member behind the register's clock says the password changed

When a member's clock ran more than its allowance behind the register's,
the session after a reset was refused as unavailable (the re-review's tenth
finding), after the register had already reset the account and ended every
session, and the app read it as "this instance has no password sign-in".
It now has a refusal of its own (passwordChanged): the app says the password
was changed and to sign in again with the new one.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_client/lib/src/protocol/password/password_refusal.dart

@@ -86,7 +86,13 @@ enum PasswordRefusal implements _isc.SerializableModel {
 
   /// Ten codes in a row from this signed-in session were wrong: the
   /// session ended (the re-review's third finding); sign in again.
-  sessionEnded;
+  sessionEnded,
+
+  /// The password was changed (a reset carried out), but this service
+  /// couldn't open a session for it yet (its clock is behind the
+  /// register's): sign in again with the new password. Never "this
+  /// instance has no password sign-in" (the re-review's tenth finding).
+  passwordChanged;
 
   static PasswordRefusal fromJson(String name) {
     switch (name) {
@@ -130,6 +136,8 @@ enum PasswordRefusal implements _isc.SerializableModel {
         return PasswordRefusal.codesWait;
       case 'sessionEnded':
         return PasswordRefusal.sessionEnded;
+      case 'passwordChanged':
+        return PasswordRefusal.passwordChanged;
       default:
         throw ArgumentError(
           'Value "$name" cannot be converted to "PasswordRefusal"',