fix(app): every change of how an account is secured asks for the password

The app's side of the owner's proof (OwnerProof, the third reading): adding
an authenticator once one is confirmed, removing a confirmed one and new
recovery codes now ask for the current password beside the code, as
changing the password, a new phrase and deleting already did; one
challenge and one answer per sheet (OwnerAnswer). A wrong password or code
reads as the one refusal the instance gives.

Deleting chooses a code by mail from what the instance says
(secondFactorWorks), no longer from whether an authenticator was ever
confirmed: with the authenticators' reset taken effect but not carried
out, the app offered a code field the instance refused (the fourth
finding). Signed-in calls take no address any more, so a device that
doesn't know it changes the password as any other; deleting by mail asks
for the address only where the device doesn't know it, as the code goes
there (the fifth finding).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_app/lib/l10n/halkyon_app_en.arb

@@ -301,6 +301,7 @@
   "passwordAuthenticatorOpen": "Open in your authenticator app",
   "passwordAuthenticatorNoApp": "No app on this device opens it. Scan the code or type in the key.",
   "passwordAuthenticatorCodeIntro": "Then enter the code it shows.",
+  "passwordAuthenticatorOwnerIntro": "To add it, confirm it is you: your password and a code from an authenticator you added before.",
   "passwordExistingCode": "Code from an authenticator you added before",
   "passwordRecoveryCodesTitle": "Recovery codes",
   "passwordRecoveryCodesIntro": "Each signs in once in place of a code from your authenticator, should you lose it. Keep them where only you find them: they're shown only now.",
@@ -380,7 +381,7 @@
       }
     }
   },
-  "passwordSectionRemoveIntro": "Enter a code from one of your authenticators to confirm.",
+  "passwordSectionRemoveIntro": "Enter your password and a code from one of your authenticators to confirm.",
   "passwordSectionRemoveAction": "Remove",
   "passwordSectionAddAuthenticator": "Add an authenticator",
   "passwordSectionRecoveryCodes": "New recovery codes",
@@ -391,7 +392,7 @@
   "passwordChangeIntro": "Your other devices are signed out. Your keys stay: nothing is lost.",
   "passwordChangeAction": "Change password",
   "passwordChanged": "Password changed. Your other devices are signed out.",
-  "passwordNewCodesIntro": "Enter a code from your authenticator app. Your old recovery codes stop working.",
+  "passwordNewCodesIntro": "Enter your password and a code from your authenticator app. Your old recovery codes stop working.",
   "passwordNewPhraseIntro": "Your new recovery phrase. Write the 24 words down in order: once you confirm it, your old phrase opens nothing any more.",
   "passwordPhraseKept": "New recovery phrase set. The old one no longer works.",
   "passwordWrongCredentials": "The address, the password or the code isn't right.",
@@ -412,7 +413,6 @@
   "passwordNoAddress": "Your account has no email address yet.",
   "passwordNoPassword": "This account has no password.",
   "passwordWrongCode": "This code isn't right. Enter the one your app shows now.",
-  "passwordWrongExistingCode": "The code from your other authenticator isn't right.",
   "passwordLastAuthenticator": "Your last authenticator can't go: every sign-in needs one.",
   "passwordTooManyAuthenticators": "Your account has as many authenticators as it may. Remove one first.",
   "passwordUnknownAuthenticator": "This authenticator is gone.",
@@ -459,8 +459,8 @@
   },
   "passwordDeleteIntro": "Your account goes with everything in it, in every service of this instance. To confirm, type your password and a code from your authenticator app.",
   "passwordSessionEnded": "Too many wrong codes in a row from this device: it was signed out. Sign in again with your password and a code.",
-  "passwordAddressUnknown": "This device doesn't know your account's address, which this takes. Sign out, then sign in again with your address and password.",
-  "passwordDeleteIntroByMail": "Your account goes with everything in it, in every service of this instance. Its authenticator isn't set up, so a code by mail confirms it: type your password, then the code we email to your address.",
+  "passwordAddressUnknown": "Enter your account's email address: the code goes there.",
+  "passwordDeleteIntroByMail": "Your account goes with everything in it, in every service of this instance. None of its authenticators works now, so a code by mail confirms it: type your password, then the code we email to your address.",
   "passwordDeleteSendCode": "Email me a code",
   "passwordChangedSignInAgain": "Your password was changed, but this service couldn't sign you in just yet. Sign in again with the new password."
 }