fix(app): GitHub's refusals say why, and no hint adds GitHub where passwords are offered

Where an instance offers password sign-in, GitHub is added to nobody (ADR
0017, D2), yet the start screen still said "then add GitHub" after a GitHub
account nobody has, and every refusal but an unknown account read
"Couldn't sign in with GitHub." (the end-to-end test of 21 Oct).

- The gateway tells from one read of the basics whether GitHub signs in and
  whether it is added to people (`gitHubOffer`, in place of
  `gitHubClientId`); the GitHub bloc keeps it (`Ready.linking`) for the
  profile, with why an attempt failed (`Ready.problem`).
- The instance's `usePassword`, `deprecated` and `ended` become problems of
  their own (`gitHubSignInProblemOf`), worded by `gitHubProblemText` and on
  the start screen; an anonymous person refused a link is told the GitHub
  account is nobody's and offered the password instead.
- Where passwords are offered, the start screen offers an account to create
  in place of the app's hint on adding GitHub.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_app/test/auth/data/serverpod_auth_gateway_test.dart

@@ -20,9 +20,12 @@ final class _MemoryStorage() implements ClientAuthSuccessStorage {
 }
 
 /// An instance's halkyon_base as the network shows it: anonymous sign-ins
-/// get `anonymous-token`, its basics offer GitHub and passwords, and a
-/// sign-up makes Ben, signed in with `ben-token`.
+/// get `anonymous-token`, its basics offer GitHub (and passwords while
+/// [passwords]), and a sign-up makes Ben, signed in with `ben-token`.
 final class _Instance() {
+  /// Whether its basics offer password sign-in.
+  bool passwords = false;
+
   static final anonymous = UuidValue.withValidation(
     '0191f0c4-1111-7000-8000-000000000001',
   );
@@ -50,6 +53,7 @@ final class _Instance() {
             emailSignIn: true,
             sourceCodeUrl: 'https://code.example.org/learn',
             minimumAppBuild: 1,
+            passwordSignIn: passwords,
           ).toJson(),
         ),
         200,
@@ -116,8 +120,44 @@ void main() {
     },
   );
 
-  test('tells what the instance offers from its basics', () async {
-    expect(await gateway.gitHubClientId(), 'github-client');
+  test('tells what the instance offers from its basics: GitHub sign-in, '
+      'and linking GitHub to people only where passwords are not', () async {
+    expect(
+      await gateway.gitHubOffer(),
+      const GitHubOffer(signIn: true, linking: true),
+    );
+
+    instance.passwords = true;
+    expect(
+      await gateway.gitHubOffer(),
+      const GitHubOffer(signIn: true, linking: false),
+    );
+    expect(
+      instance.calls.where(
+        (each) => each.call == 'halkyon_base.instance/basics',
+      ),
+      hasLength(2),
+      reason: 'one read of the basics each',
+    );
+  });
+
+  test("puts the instance's refusals of GitHub as the app's problems", () {
+    expect(
+      {
+        for (final reason in GitHubSignInRefusal.values)
+          reason: gitHubSignInProblemOf(reason),
+      },
+      {
+        GitHubSignInRefusal.unavailable: GitHubSignInProblem.refused,
+        GitHubSignInRefusal.takenByAnotherPerson: GitHubSignInProblem.refused,
+        GitHubSignInRefusal.otherGitHubAccountLinked:
+            GitHubSignInProblem.refused,
+        GitHubSignInRefusal.unknownAccount: GitHubSignInProblem.unknownAccount,
+        GitHubSignInRefusal.usePassword: GitHubSignInProblem.usePassword,
+        GitHubSignInRefusal.deprecated: GitHubSignInProblem.deprecated,
+        GitHubSignInRefusal.ended: GitHubSignInProblem.ended,
+      },
+    );
   });
 
   test('a session granted elsewhere (a sign-up with a password, without '