fix(auth): a member's clock off the register's ends the sessions of its gap, waiting for nothing

The reading of the full reading's fixes found (C1) that refusing a member
whose clock ran ahead protected only the reset's own session: a session
made on that member in the gap, by whoever knew the old password, outlived
both the member's ending and the register's notice.

issueSessionAfter now ends every session of the account here made before
the register's moment or before now, whichever is later, then makes the
new one, neither waiting nor refusing; and the register sends its clock
with each notice (sentAt), so a member takes the moment by its own clock
(as long before now as it was before it was sent), ending the gap's
sessions and leaving those made since. The passwordChanged refusal, sent
only by the clock checks, goes with them (unreleased).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_app/lib/l10n/halkyon_app_de.arb

@@ -219,7 +219,6 @@
   "passwordAddressUnknown": "Gib die E-Mail-Adresse deines Kontos ein: Dorthin geht der Code.",
   "passwordDeleteIntroByMail": "Dein Konto wird mit allem darin gelöscht, in jedem Dienst dieser Instanz. Keiner seiner Authenticators funktioniert gerade, daher bestätigt es ein Code per E-Mail: Gib dein Passwort ein, dann den Code, den wir an deine Adresse schicken.",
   "passwordDeleteSendCode": "Code per E-Mail schicken",
-  "passwordChangedSignInAgain": "Dein Passwort wurde geändert, aber dieser Dienst konnte dich gerade noch nicht anmelden. Melde dich wieder mit dem neuen Passwort an.",
   "passwordSignInAgain": "Um einem Konto, das sich mit GitHub anmeldet, ein Passwort zu geben, melde dich erst wieder mit GitHub an: Es ist mehr als ein paar Minuten her.",
   "passwordSignInWithGitHubAgain": "Wieder mit GitHub anmelden",
   "passwordOfferTitle": "Richte ein Passwort ein",

packages/halkyon_app/lib/l10n/halkyon_app_en.arb

@@ -483,7 +483,6 @@
   "passwordAddressUnknown": "Enter your account's email address: the code goes there.",
   "passwordDeleteIntroByMail": "Your account goes with everything in it, in every service of this instance. None of its authenticators works now, so a code by mail confirms it: type your password, then the code we email to your address.",
   "passwordDeleteSendCode": "Email me a code",
-  "passwordChangedSignInAgain": "Your password was changed, but this service couldn't sign you in just yet. Sign in again with the new password.",
   "passwordSignInAgain": "To give an account that signs in with GitHub its password, sign in with GitHub again first: it has been more than a few minutes.",
   "passwordSignInWithGitHubAgain": "Sign in with GitHub again",
   "passwordOfferTitle": "Set up a password",

packages/halkyon_app/lib/l10n/halkyon_app_localizations.dart

@@ -1417,12 +1417,6 @@ abstract class HalkyonAppLocalizations {
   /// **'Email me a code'**
   String get passwordDeleteSendCode;
 
-  /// No description provided for @passwordChangedSignInAgain.
-  ///
-  /// In en, this message translates to:
-  /// **'Your password was changed, but this service couldn\'t sign you in just yet. Sign in again with the new password.'**
-  String get passwordChangedSignInAgain;
-
   /// No description provided for @passwordSignInAgain.
   ///
   /// In en, this message translates to:

packages/halkyon_app/lib/l10n/halkyon_app_localizations_de.dart

@@ -824,10 +824,6 @@ class HalkyonAppLocalizationsDe extends HalkyonAppLocalizations {
   @override
   String get passwordDeleteSendCode => 'Code per E-Mail schicken';
 
-  @override
-  String get passwordChangedSignInAgain =>
-      'Dein Passwort wurde geändert, aber dieser Dienst konnte dich gerade noch nicht anmelden. Melde dich wieder mit dem neuen Passwort an.';
-
   @override
   String get passwordSignInAgain =>
       'Um einem Konto, das sich mit GitHub anmeldet, ein Passwort zu geben, melde dich erst wieder mit GitHub an: Es ist mehr als ein paar Minuten her.';

packages/halkyon_app/lib/l10n/halkyon_app_localizations_en.dart

@@ -807,10 +807,6 @@ class HalkyonAppLocalizationsEn extends HalkyonAppLocalizations {
   @override
   String get passwordDeleteSendCode => 'Email me a code';
 
-  @override
-  String get passwordChangedSignInAgain =>
-      'Your password was changed, but this service couldn\'t sign you in just yet. Sign in again with the new password.';
-
   @override
   String get passwordSignInAgain =>
       'To give an account that signs in with GitHub its password, sign in with GitHub again first: it has been more than a few minutes.';

packages/halkyon_app/lib/src/password/data/serverpod_password_gateway.dart

@@ -464,7 +464,6 @@ PasswordProblem _problemOf(protocol.PasswordRefusal reason) => switch (reason) {
   protocol.PasswordRefusal.otherInstance => PasswordProblem.instanceUnproven,
   protocol.PasswordRefusal.codesWait => PasswordProblem.codesWait,
   protocol.PasswordRefusal.sessionEnded => PasswordProblem.sessionEnded,
-  protocol.PasswordRefusal.passwordChanged => PasswordProblem.passwordChanged,
   protocol.PasswordRefusal.signInAgain => PasswordProblem.signInAgain,
   protocol.PasswordRefusal.signedInBefore => PasswordProblem.signedInBefore,
 };

packages/halkyon_app/lib/src/password/model/password_failed.dart

@@ -25,10 +25,6 @@ enum PasswordProblem() {
   /// device signs in again.
   sessionEnded,
 
-  /// The password was changed by a reset, but this service couldn't open a
-  /// session for it yet: sign in again with the new password.
-  passwordChanged,
-
   /// An account that signs in with GitHub alone takes its first password
   /// only within minutes of a GitHub sign-in: sign in with GitHub again,
   /// then go on.

packages/halkyon_app/lib/src/password/widget/password_texts.dart

@@ -25,7 +25,6 @@ String passwordProblemText(BuildContext context, PasswordFailed failed) {
       null => l10n.passwordTooManyAttempts,
     },
     PasswordProblem.sessionEnded => l10n.passwordSessionEnded,
-    PasswordProblem.passwordChanged => l10n.passwordChangedSignInAgain,
     PasswordProblem.signInAgain => l10n.passwordSignInAgain,
     PasswordProblem.signedInBefore => l10n.passwordSignedInBefore,
     PasswordProblem.noReset => l10n.passwordNoReset,