fix(app): the short reading's nits on the device

- Deleting an identified account whose security can't be read (the
  instance out of reach) says so and deletes nothing; it went on to a
  deletion by the session alone, refused for an account with a password,
  and the person saw a spinner, then nothing. A refusal still leaves the
  session's own deletion.
- InstanceChoice's sharesStorage is required, so no app leaves it out and
  removes a folder another instance uses.
- A PasswordUnlock forgotten is spent: its secrets read again fail
  (StateError) rather than make a proof or a wrapping of zeros.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_app/test/auth/widget/account_tiles_test.dart

@@ -95,6 +95,7 @@ void main() {
       MemoryInstanceStore((current: instance, known: [instance])),
       builtIn: instance,
       forget: (instance) async {},
+      sharesStorage: (a, b) => false,
     );
     await choice.load(usedBefore: false);
     await start(tester, choice: choice);
@@ -174,6 +175,31 @@ void main() {
     expect(find.text('Signed out'), findsOneWidget);
   });
 
+  testWidgets('deleting an identified account while the instance is out of '
+      'reach says so, and deletes nothing (the short reading)', (tester) async {
+    gateway = FakeAuthGateway(
+      status: const SignedIn(authUserId: 'github-1', isIdentified: true),
+    );
+    await start(tester);
+    dependencies.passwordGateway.failing = const PasswordFailed(
+      PasswordProblem.failed,
+    );
+
+    await tester.tap(find.text('Delete account'));
+    await tester.pumpAndSettle();
+    await tester.tap(find.text('Delete account').last);
+    await tester.pumpAndSettle();
+
+    expect(
+      find.text(
+        "Couldn't reach the instance. Check the connection and try again.",
+      ),
+      findsOneWidget,
+    );
+    expect(gateway.accountDeletions, 0);
+    expect(find.text('App of github-1'), findsOneWidget);
+  });
+
   testWidgets('deleting an account whose setup never finished asks for the '
       'password and a code by mail', (tester) async {
     // The first person the fake password gateway makes.