fix(auth)!: the first authenticator takes the password, and a reset ends every session

The fourth reading's second finding: a stolen session outlived the reset
of the authenticators (carrying it out ended no session) and confirmed
the account's first authenticator on its own code alone, ahead of the
owner, so the owner's confirmation and sign-in were refused after.

- Carrying out a reset of the authenticators ends every session of the
  account, on the register at once and on every member by notice, as the
  other resets do; the sign-in that carries it out gets its session after
  that moment (PasswordProof.sessionsEndedBefore, issueSessionAfter).
- Confirming the first authenticator takes the password's proof for a
  change's challenge, without a code (proveOwnersPassword), counted per
  session as the owner's proofs are: a session of a lost phone, or of a
  setup never finished, claims no second factor.

The app sends the password with every confirmation: the sign-up's, a
reset's and the account section's (which asks for it), and a sign-in's
own unlock where the session is still held back.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_app/lib/l10n/halkyon_app_de.arb

@@ -220,5 +220,6 @@
   "passwordSignInWithGitHubAgain": "Wieder mit GitHub anmelden",
   "passwordOfferTitle": "Richte ein Passwort ein",
   "passwordOfferBody": "Die Anmeldung mit GitHub endet. Richte ein Passwort und eine Authenticator-App ein, um dein Konto zu behalten.",
-  "passwordOfferLater": "Später"
+  "passwordOfferLater": "Später",
+  "passwordAuthenticatorPasswordIntro": "Bestätige zum Hinzufügen mit deinem Passwort, dass du es bist."
 }

packages/halkyon_app/lib/l10n/halkyon_app_en.arb

@@ -467,5 +467,6 @@
   "passwordSignInWithGitHubAgain": "Sign in with GitHub again",
   "passwordOfferTitle": "Set up a password",
   "passwordOfferBody": "Sign-in with GitHub is ending. Set up a password and an authenticator app to keep your account.",
-  "passwordOfferLater": "Later"
+  "passwordOfferLater": "Later",
+  "passwordAuthenticatorPasswordIntro": "To add it, confirm it is you with your password."
 }

packages/halkyon_app/lib/l10n/halkyon_app_localizations.dart

@@ -1428,6 +1428,12 @@ abstract class HalkyonAppLocalizations {
   /// In en, this message translates to:
   /// **'Later'**
   String get passwordOfferLater;
+
+  /// No description provided for @passwordAuthenticatorPasswordIntro.
+  ///
+  /// In en, this message translates to:
+  /// **'To add it, confirm it is you with your password.'**
+  String get passwordAuthenticatorPasswordIntro;
 }
 
 class _HalkyonAppLocalizationsDelegate

packages/halkyon_app/lib/l10n/halkyon_app_localizations_de.dart

@@ -828,4 +828,8 @@ class HalkyonAppLocalizationsDe extends HalkyonAppLocalizations {
 
   @override
   String get passwordOfferLater => 'Später';
+
+  @override
+  String get passwordAuthenticatorPasswordIntro =>
+      'Bestätige zum Hinzufügen mit deinem Passwort, dass du es bist.';
 }

packages/halkyon_app/lib/l10n/halkyon_app_localizations_en.dart

@@ -811,6 +811,10 @@ class HalkyonAppLocalizationsEn extends HalkyonAppLocalizations {
 
   @override
   String get passwordOfferLater => 'Later';
+
+  @override
+  String get passwordAuthenticatorPasswordIntro =>
+      'To add it, confirm it is you with your password.';
 }
 
 /// The translations for English, as used in the United Kingdom (`en_GB`).