fix(auth): every call with a code after the password takes the address

Whoever guessed codes decided whether the owner was mailed (the re-review's
fourth finding): the address a sign-in sent was optional, so a guesser left
it out and no mail went, and a wait begun without a mail used up the one
mail there was. Every call carrying a code after the password or the phrase
proved (signing in, the phrase's reset, a change of password, a new phrase,
deletion) now takes the account's address and the language of its mails,
and is refused (wrongCredentials, as anything wrong after the password)
before any code is checked when the address isn't the account's; every
wait mails the owner, not only the first. The app sends the address the
person typed, or for changes while signed in the one this device signed in
with, and says so where it doesn't know it (addressUnknown).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_server/lib/src/register/account_register.dart

@@ -171,8 +171,8 @@ abstract interface class AccountRegister {
     UuidValue? request,
     String? code,
     required String host,
-    String? address,
-    String? language,
+    required String address,
+    required String language,
   });
 
   /// Signs up with the address [code] proves for [request] and the password
@@ -261,8 +261,8 @@ abstract interface class AccountRegister {
     String? totpCode,
     String? recoveryCode,
     required String host,
-    String? address,
-    String? language,
+    required String address,
+    required String language,
   });
 
   /// Asks for the reset of a whole account. Refusals as
@@ -306,6 +306,8 @@ abstract interface class AccountRegister {
     required NewPassword password,
     UuidValue? keepSession,
     required String host,
+    required String address,
+    required String language,
   });
 
   /// Replaces the wrapping of [person]'s keys under their recovery phrase
@@ -322,6 +324,8 @@ abstract interface class AccountRegister {
     required WrappedKeys recoveryKeys,
     required ByteData recoveryProofKey,
     required String host,
+    required String address,
+    required String language,
   });
 
   /// Deletes the account [person] with everything the register's server has