fix(auth): an account with a password deletes itself only with it and a code

A session alone deleted any account, with everything encrypted under its
keys (the second reading's lows; decided by the developer: the password
and a code, as a change of password takes). account.delete now takes a
DeletionProof (the password's SRP proof for a beginChange challenge, a
TOTP or recovery code, the host the device addressed); the register
checks it (requireOwnerToDelete), a member passing it on bound to its own
host. Accounts without a password, anonymous ones among them, delete with
their session as before. In the app, deleting an account with a password
asks for it and a code in a sheet of its own; a wrong one deletes
nothing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_server/lib/src/register/account_register.dart

@@ -325,8 +325,13 @@ abstract interface class AccountRegister {
   });
 
   /// Deletes the account [person] with everything the register's server has
-  /// of them, and has every member of the instance delete theirs.
-  Future<void> deleteAccount(Session session, UuidValue person);
+  /// of them, and has every member of the instance delete theirs: one with a
+  /// password only with [proof] (`requireOwnerToDelete`).
+  Future<void> deleteAccount(
+    Session session,
+    UuidValue person, {
+    DeletionProof? proof,
+  });
 
   /// Those of [people] that are accounts of the register.
   Future<Set<UuidValue>> knownAccounts(