Fix password reminder after settings unlock

[j0ntz]

Description

The password reminder ("Security Check: Tap to verify password") stopped
reappearing after a user visited Account Settings, which is what QA hit while
following the Change Username repro in
https://app.asana.com/0/1215088146871429/1213821580712784.

One password entry at the unlock modal reached the reducer as two or three
separate password uses:

sequenceDiagram
    autonumber
    actor User
    participant Scene as SettingsScene
    participant Settings as SettingsActions
    participant Acct as AccountActions
    participant Reducer as PasswordReminderReducer

    User->>Scene: tap "Change Username" while locked
    Scene->>Settings: showUnlockSettingsModal()
    Settings->>Acct: validatePassword()
    Acct->>Acct: account.checkPassword(pw) succeeds
    Acct->>Reducer: PASSWORD_USED
    Note over Reducer: passwordUseCount 0 to 1<br/>(correct, kept)
    Settings->>Reducer: SET_SETTINGS_LOCK false
    Note over Reducer: translateAction mapped this<br/>to PASSWORD_USED: 1 to 2<br/>(removed by this PR)
    Scene->>Reducer: SET_SETTINGS_LOCK false again
    Note over Reducer: third PASSWORD_USED: 2 to 3<br/>(dispatch removed by this PR)

Loading

Step 5 is the correct count. Step 6 double-counts it, and step 7 both counts it
a third time and re-dispatches an unlock that step 6 already performed. Every
path that unlocks Account Settings goes through validatePassword, so the
SET_SETTINGS_LOCK translation added no coverage the canonical dispatch lacked.

The reminder thresholds are 4 ** passwordUseCount, so one visit to Account
Settings moved the next reminder far out of reach:

One unlock, entered from	passwordUseCount	Logins until the next reminder
the lock row, before	2	16
the Change Username row, before	3	64
either row, after this PR	1	4

The username change itself was incidental. Account Settings is the trigger, and
the same escalation applied to Change Password, Change PIN, 2FA, Recovery and
Delete Account, which all go through hasLock.

The fix makes one password entry count exactly once. The backoff design is
unchanged. Adds a regression test covering the unlock dispatch sequence.

CHANGELOG

Does this branch warrant an entry to the CHANGELOG?

• Yes
• No

Dependencies

none

Requirements

If you have made any visual changes to the GUI. Make sure you have:

• Tested on iOS device
• Tested on Android device
• Tested on small-screen device (iPod Touch)
• Tested on large-screen device (tablet)

[j0ntz]

📸 Test evidence (iOS sim, reminder constants hacked to initial 1 / growth 2 so the condition is reachable in a few logins)

reminder shows after pin login

username changed

reminder returns after username change

Captured by the agent's in-app test run (build-and-test).

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.