docs(auth): the apps' screens decided (ADR 0017)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

docs/adr/0017-password-totp-and-keys.md

@@ -83,6 +83,12 @@ that the instance doesn't also know, so nothing could be encrypted for the perso
 - **Also (20 Oct, at the crypto core's review):** recovery codes kept under the instance's
   key (5); passwords taken as RFC 8265's OpaqueString (other spaces to a plain space, NFC,
   control characters refused) before Argon2id, so a password unlocks alike on every system.
+- **Also (20 Oct, before the apps' screens):** they come with build 22, after the second
+  reading, not build 21 (which ships with password sign-in off on learn.halkyon.eu, its
+  keys unset); sign-up shows the recovery phrase once and goes on once three of its words,
+  chosen at random, are typed back; the unlocked private keys stay in the system's keyring
+  after signing in, as sessions do, and go with signing out; changing the password while
+  signed in takes the old password (SRP) and a TOTP code.
 
 ## Settled in building the register's side (20 Oct 2026)