feat(app): a reset of the keys without the phrase, its banner, and the keys' proof key for a password that signs in (ADR 0020, D31–D35)

SimpleLogin's sheet, its password and its recovery phrase both lost:
under the lost-password step's phrase field, Lost your recovery phrase
too? says what stays and what is lost and asks for new keys
(`keys.startReset`) with the sign-in of a moment ago, which the device
then drops. The next sign-in says when while it waits, and once due
offers new keys, the sign-up's own password and phrase steps
(`keys.completeReset`), or the password, which calls it off (D31).

Every app's home shows `KeysResetBanner` where "too old" shows, and the
account section's SimpleLogin row the same words (`KeysResetNotice`),
each with Call it off, the password's proof alone
(`keys.callOffResets`, D32), and, once due on a device that holds the
keys, Finish here, which wraps the same keys anew (D33, D35). Both show
only a reset of an account that signs in with SimpleLogin alone; ADR
0017's resets show in its own section, which now shares `AlertBox` with
them.

An account whose password signs in has no Forgot your password? there,
and is asked its password and a code once while its keys lack the proof
key, at a sign-in or on adding SimpleLogin (`password.setProofKey`,
D34). `PasswordUnlock` carries the proof key, which its forgetting
leaves, and the keys' password proves for a purpose given.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

docs/adr/0020-sign-in-with-simplelogin.md

@@ -1,6 +1,6 @@
 # ADR 0020: Signing in with SimpleLogin only
 
-- **Status:** decided 23 Oct 2026, by the developer (D1–D20 below; D21–D34 on 24
+- **Status:** decided 23 Oct 2026, by the developer (D1–D20 below; D21–D35 on 24
   Oct), the *Proposal* with it (D15), as D18 to D20 change it and D24 drops the
   cut-off's machinery (D8's code, D10, D22, 10's `ANONYMOUS_SESSIONS_END`, 11, step 5).
 - **Built (23 Oct 2026), step 1:** the forwarding page (3),
@@ -125,6 +125,20 @@
   says whether the password signs in too (`passwordSignsIn`), whether the keys have the
   proof key (`hasProofKey`) and when a reset takes effect (`accountResetAt`). No
   migration: the reset is ADR 0017's `account_reset` row of kind `account`.
+  Then the app's half (D31–D35): under the lost-password step's phrase field, Lost your
+  recovery phrase too? explains what stays and what is lost and asks for new keys with
+  the sign-in of a moment ago, which the device then drops; the next sign-in says when
+  while it waits, and once due offers new keys (the sign-up's password and phrase steps)
+  or the password. An account whose password signs in has no Forgot your password? there
+  and is asked its password and a code once, while its keys lack the proof key (D34),
+  with two Argon2id runs (the proof, then the unlock), as it happens once. Every app's
+  home shows `KeysResetBanner` where "too old" shows, and the account section's
+  SimpleLogin row the same words (`KeysResetNotice`), each with Call it off (the
+  password, D32) and, once due on a device that holds the keys, Finish here (D33); both
+  show only a reset of an account that signs in with SimpleLogin alone, as ADR 0017's
+  resets show in its own section. The security section's boxes and this one share
+  `AlertBox`. Left for later: an account whose password signs in, on an instance that
+  offers SimpleLogin alone, has no password sign-in to reset a lost password from.
 - **Builds on:** ADR 0010 (email sign-in), ADR 0011 (profile pages), ADR 0016 (the
   register), ADR 0017 (a password, TOTP and the keys).
 - **Changes:** ADR 0017's way in on an instance that offers SimpleLogin (its keys, their
@@ -346,6 +360,11 @@ against app.simplelogin.io on 23 Oct:
   its keys through `keys.unlock` but changes nothing through `keys`: its changes and
   resets stay ADR 0017's, which keep SRP's verifier in step. `simpleLogin.complete` says
   whether the password signs in and has the proof key.
+- **D35 The banner on each app's home and in the account section** (24 Oct,
+  recommended, over the account section alone, as ADR 0017's resets show, which the
+  owner sees only on opening it, and over the home alone): at the top of the home,
+  where an app too old for its instance shows, and under the SimpleLogin row, each with
+  Call it off.
 - **Also (23 Oct):** the developer's own account moves by adding SimpleLogin to it while
   signed in with GitHub; the instance's SimpleLogin app goes up for approval once
   halkyon.app/learn exists, before learn.halkyon.eu switches.