fix(auth): a setup's password replaced ends the account's other sessions

The full reading's L4: password.set replacing the password of a setup never
finished (no authenticator confirmed yet) ended no session, against the
rule that every new password ends the account's other sessions. Now it
ends them all but the session asking, here and on every member (as a
change does; keepSession, which a member forwards).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_server/test/integration/password/password_test.dart

@@ -533,6 +533,29 @@ void main() {
           expect(await scopesOf(anna), isNot(contains(identified.name)));
         });
 
+        test('replaced before an authenticator is confirmed, ends every '
+            "other session of the account (the full reading's L4)", () async {
+          await annaSetsPassword();
+          final annasLaptop = await signInNewDevice(session, anna);
+          final code = await ownAddressCode();
+          final other = await PasswordDevice.make(seed: 23);
+          await endpoints.password.set(
+            asAnna(),
+            setup: other.setup(),
+            request: code.request,
+            code: code.code,
+          );
+          final sessions = {
+            for (final row in await ServerSideSession.db.find(
+              session,
+              where: (t) => t.authUserId.equals(anna),
+            ))
+              row.id,
+          };
+          expect(sessions, contains(annasPhone));
+          expect(sessions, isNot(contains(annasLaptop)));
+        });
+
         test('replaces the password until an authenticator is confirmed, '
             'then is refused', () async {
           await annaSetsPassword();

packages/halkyon_base_server/test/integration/register/member_test.dart

@@ -251,6 +251,7 @@ final class _Register implements AccountRegister {
     String? code,
     bool freshGitHubSignIn = false,
     bool anonymousHere = false,
+    UuidValue? keepSession,
   }) => _answer('setPassword', () {
     add(person);
     passwords.add(person);