fix(auth)!: the first authenticator takes the password, and a reset ends every session

The fourth reading's second finding: a stolen session outlived the reset
of the authenticators (carrying it out ended no session) and confirmed
the account's first authenticator on its own code alone, ahead of the
owner, so the owner's confirmation and sign-in were refused after.

- Carrying out a reset of the authenticators ends every session of the
  account, on the register at once and on every member by notice, as the
  other resets do; the sign-in that carries it out gets its session after
  that moment (PasswordProof.sessionsEndedBefore, issueSessionAfter).
- Confirming the first authenticator takes the password's proof for a
  change's challenge, without a code (proveOwnersPassword), counted per
  session as the owner's proofs are: a session of a lost phone, or of a
  setup never finished, claims no second factor.

The app sends the password with every confirmation: the sign-up's, a
reset's and the account section's (which asks for it), and a sign-in's
own unlock where the session is still held back.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_app/test/password/bloc/account_security_cubit_test.dart

@@ -207,8 +207,8 @@ void main() {
       expect(anna.authenticators.where((each) => each.confirmed), hasLength(2));
     });
 
-    test("the first after a reset brings recovery codes, without another's "
-        'code', () async {
+    test('the first after a reset brings recovery codes, with the password '
+        "alone (the fourth reading), without another's code", () async {
       anna.authenticators.clear();
       final cubit = AddAuthenticatorCubit(
         passwords,
@@ -219,7 +219,23 @@ void main() {
       addTearDown(cubit.close);
       await cubit.start();
 
-      await cubit.codeEntered(fakeTotpCode, existingCode: 'ignored');
+      await cubit.codeEntered(
+        fakeTotpCode,
+        password: 'wrong horse',
+        existingCode: 'ignored',
+      );
+      expect(
+        cubit.state,
+        at(
+          AddAuthenticatorStep.code,
+          problem: PasswordProblem.wrongCredentials,
+        ),
+      );
+      await cubit.codeEntered(
+        fakeTotpCode,
+        password: 'correct horse',
+        existingCode: 'ignored',
+      );
 
       expect(cubit.state, at(AddAuthenticatorStep.recoveryCodes));
       expect(cubit.state.recoveryCodes, hasLength(10));