fix(auth): a new recovery phrase takes the password too

password.setRecoveryKeys took a session and a TOTP code alone, so a phone
signed in with its authenticator beside it could set a phrase of its
holder's own and, through the phrase's reset, a new password, never
knowing the old one. It now takes the old password's SRP proof (from
beginChange, the caller's own) and a TOTP or recovery code, as changing
the password does: one owner proof for both (_proveOwner), forwarded by
members, asked for in the account section's New recovery phrase.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_app/test/password/data/password_repository_test.dart

@@ -302,15 +302,33 @@ void main() {
         expect(anna.password, 'correct horse');
       });
 
-      test('makes a new recovery phrase, which the instance takes for a '
-          'code', () async {
+      test('makes a new recovery phrase, which the instance takes for the '
+          'password and a code alone', () async {
         final phrase = await passwords.newPhrase();
+        final before = anna.recoveryKeys;
         await expectLater(
-          passwords.keepPhrase(phrase, '000000'),
-          failsWith(PasswordProblem.wrongCode),
+          passwords.keepPhrase(
+            phrase,
+            password: 'correct horse',
+            code: '000000',
+          ),
+          failsWith(PasswordProblem.wrongCredentials),
         );
+        await expectLater(
+          passwords.keepPhrase(
+            phrase,
+            password: 'wrong',
+            code: fakeTotpCode,
+          ),
+          failsWith(PasswordProblem.wrongCredentials),
+        );
+        expect(anna.recoveryKeys, same(before));
 
-        await passwords.keepPhrase(phrase, fakeTotpCode);
+        await passwords.keepPhrase(
+          phrase,
+          password: 'correct horse',
+          code: fakeTotpCode,
+        );
 
         await auth.signOut();
         final pending = await passwords.resetPassword(