feat(auth): a session ended for its wrong proofs warns its owner

The tenth wrong owner proof in a row ends a session (the third
reading); someone holding that session tried the password or its
codes. The register now keeps the moment with the account's password
(`account_password.sessionEndedForProofsAt`): the account's sign-in
ways and its next password sign-in carry it, until the owner dismisses
it (`password.dismissSessionEndedWarning`, their session alone: it
hides a warning and secures nothing) or sets a new password. A member
ending its own session tells the register
(`noteSessionEndedForProofs`); a register out of reach leaves the
owner unwarned, the session ended all the same.

Migration (module, Learn's and Todo's servers, Learn's device schema):
ALTER TABLE "account_password" ADD COLUMN "sessionEndedForProofsAt"
timestamp without time zone; nullable, so every row keeps its values
and has no warning.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_server/lib/src/register/instance_api.dart

@@ -198,6 +198,15 @@ Future<Map<String, Object?>?> _answer(
         arguments.id('person'),
       );
       return {'ways': ways.toJson()};
+    case RegisterOperation.noteSessionEndedForProofs:
+      await register.noteSessionEndedForProofs(session, arguments.id('person'));
+      return const {};
+    case RegisterOperation.dismissSessionEndedWarning:
+      await register.dismissSessionEndedWarning(
+        session,
+        arguments.id('person'),
+      );
+      return const {};
     case RegisterOperation.deleteAccount:
       await register.deleteAccount(
         session,