Reset your chat key

Needs a person's signed-in web session AND their password (the derived auth string, as at every vault gate) plus the unlocked messages key on the client: an api-key, agent, guest, sld_, OAuth token or a browser-linked sign-in is 403. All or nothing, under a lock on the user row: the old key is retired (kept, wrapped under the NEW messages key, so old history stays readable) and a new key goes active at generation + 1; a NEW vault version is written with new wraps (never the old key); the owner's vault-scheme agent keys are re-wrapped (agent_rewraps, each checked by fingerprint); every other session is signed out; linked devices not in reseals are unlinked, ticked ones get their re-sealed keyring to pick up; live location shares and calls end. Emails the person (critical, cannot be switched off) and tells everyone who shares a chat (member_key_changed live event). dry_run:true changes nothing, asks no password and returns what a reset would touch. The response carries a fresh jwt (also in the Authorization header): the caller's old one is dead. There is no Idempotency-Key replay (that would store a JWT); a retry after success is 409 stale_generation. The "Lost a device" variant adds new_password (a new derived auth string): the password changes in the same transaction and every linked computer is signed out (send reseals: []). Branch on code.