fix(auth): adding an authenticator takes a code from one confirmed before

Enrolling and confirming an authenticator took only a session, so whoever
held one (a stolen token) could add a second factor of their own, then use
its codes to remove the owner's and make new recovery codes.

While the account has a confirmed authenticator, confirming another now
also takes a code from one of those (`existingCode`, each step's code once
as signing in takes it, within the same 10 tries an hour), refused as
`wrongExistingCode`; it is checked only once the new one's code is right,
so a wrong one uses none. The first authenticator, and the first after a
reset carried out, need none. Members forward it to the register.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_server/lib/src/register/instance_api.dart

@@ -263,6 +263,7 @@ Future<Map<String, Object?>?> _answer(
         person: arguments.id('person'),
         authenticator: arguments.id('authenticator'),
         code: arguments.string('code'),
+        existingCode: arguments.optionalString('existingCode'),
       );
       return {'recoveryCodes': codes};
     case RegisterOperation.authenticatorsOf: