fix(auth): a reset waits while its owner is held out, and devices show it

The full reading's H1: an owner could be kept from calling a reset off, and
the reset then went through. Whoever knew the password and had the mailbox
asked an authenticators' reset and kept the codes waiting, so the owner's
sign-ins were refused until it took effect; whoever had the mailbox filled
the address's proofs ceiling from three networks and completed an account
reset. Now every hold-out of the owner after a reset was asked (a wait
that begins, an attempt a wait refuses, a sign-in or proof refused by the
address's ceiling) moves the account's resets not carried out to take
effect no sooner than 72 hours after it ends (pushOutResets). A reset
carried out (the password alone signing in until an authenticator is
confirmed) is never pushed, nor a lapsed one brought back.

Signed-in devices are told too: SignInWays carries when a waiting reset
of each kind takes effect, the account section shows them with Call it
off, which takes the owner's proof (password and code; password.
callOffResets, forwarded by members) and calls every reset off, as no wait
holds a signed-in owner's proof back. Texts in English and German.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_server/test/integration/register/register_test.dart

@@ -868,6 +868,29 @@ void main() {
                   ),
                 ),
               );
+
+              // The member's device is shown the reset, and its owner calls
+              // it off with their proof (the full reading's H1).
+              expect(
+                (await remote.signInWaysOf(session, annaOnTodo)).accountResetAt,
+                pending.takesEffectAt,
+              );
+              now = now.add(totpPeriod);
+              await remote.callOffResets(
+                session,
+                person: annaOnTodo,
+                proof: device.ownerProof(
+                  await remote.beginPasswordChange(
+                    session,
+                    person: annaOnTodo,
+                  ),
+                  totpCode: codeOf(enrolment),
+                ),
+              );
+              expect(
+                (await remote.signInWaysOf(session, annaOnTodo)).accountResetAt,
+                isNull,
+              );
             });
           },
         );