fix(auth): adding an authenticator takes a code from one confirmed before

Enrolling and confirming an authenticator took only a session, so whoever
held one (a stolen token) could add a second factor of their own, then use
its codes to remove the owner's and make new recovery codes.

While the account has a confirmed authenticator, confirming another now
also takes a code from one of those (`existingCode`, each step's code once
as signing in takes it, within the same 10 tries an hour), refused as
`wrongExistingCode`; it is checked only once the new one's code is right,
so a wrong one uses none. The first authenticator, and the first after a
reset carried out, need none. Members forward it to the register.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_server/test/integration/test_tools/serverpod_test_tools.dart

@@ -931,6 +931,7 @@ class _AuthenticatorEndpoint {
     _ist.TestSessionBuilder sessionBuilder, {
     required _is.UuidValue authenticator,
     required String code,
+    String? existingCode,
   }) async {
     return _ist.callAwaitableFunctionAndHandleExceptions(() async {
       var _localUniqueSession =
@@ -946,6 +947,7 @@ class _AuthenticatorEndpoint {
           parameters: _ist.testObjectToJson({
             'authenticator': authenticator,
             'code': code,
+            'existingCode': existingCode,
           }),
           serializationManager: _serializationManager,
         );