fix(auth)!: the first authenticator takes the password, and a reset ends every session

The fourth reading's second finding: a stolen session outlived the reset
of the authenticators (carrying it out ended no session) and confirmed
the account's first authenticator on its own code alone, ahead of the
owner, so the owner's confirmation and sign-in were refused after.

- Carrying out a reset of the authenticators ends every session of the
  account, on the register at once and on every member by notice, as the
  other resets do; the sign-in that carries it out gets its session after
  that moment (PasswordProof.sessionsEndedBefore, issueSessionAfter).
- Confirming the first authenticator takes the password's proof for a
  change's challenge, without a code (proveOwnersPassword), counted per
  session as the owner's proofs are: a session of a lost phone, or of a
  setup never finished, claims no second factor.

The app sends the password with every confirmation: the sign-up's, a
reset's and the account section's (which asks for it), and a sign-in's
own unlock where the session is still held back.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_client/lib/src/protocol/client.dart

@@ -372,10 +372,10 @@ class EndpointAuthenticator extends _isc.EndpointRef {
     },
   );
 
-  /// Confirms [authenticator] with a [code] from it, and, where the account
-  /// has a confirmed authenticator already, the owner's [proof]; the
-  /// account's first returns its recovery codes, shown once. Refusals as
-  /// `confirmAuthenticator`'s.
+  /// Confirms [authenticator] with a [code] from it and the owner's [proof]:
+  /// the password and a code from a confirmed authenticator, or, for the
+  /// account's first, the password alone; the first returns its recovery
+  /// codes, shown once. Refusals as `confirmAuthenticator`'s.
   _ida.Future<List<String>> confirm({
     required _isc.UuidValue authenticator,
     required String code,