docs(auth): the owner's warning when ten wrong proofs end a session (ADR 0017)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_server/README.md

@@ -244,7 +244,13 @@ Built on the three parts above, on the register (members forward every step thro
   checked; the tenth wrong in a row ends the session (`sessionEnded`), only a proof
   accepted clears the count, and a try that checked none is taken back. Never toward the
   account's waits, nor waiting for them: whoever knows the password holds no signed-in
-  owner out of changing it, and a new password forgets those waits.
+  owner out of changing it, and a new password forgets those waits. A session ended so
+  warns its owner: the register keeps the moment (`account_password`'s
+  `sessionEndedForProofsAt`; a member's ended session tells it through
+  `noteSessionEndedForProofs`, a register out of reach leaving the owner unwarned), which
+  `account.signInWays` and the next `passwordSignIn.complete` carry until the owner
+  dismisses it (`password.dismissSessionEndedWarning`, the session alone: it hides a
+  warning) or sets a new password.
 - **Authenticators:** a secret made on the register, shown once as an `otpauth://` URI
   (issuer: the account domain); confirmed by a code from it and the owner's proof, so a
   session alone adds no second factor: while the account has a confirmed one, the