fix(auth): a code by mail serves only what it was asked for

Codes by mail were tied to nothing but their address (the re-review's
seventh finding): a hostile instance could answer that a setup never
finished, have the person type a code into it, relay it to start the real
instance's account reset, and 72 hours later relay a second to finish it
with its own password and keys; the mail said "to sign in" whatever the
code was for. A code is now asked for a purpose (signUp, finishSetup,
authenticatorReset, accountReset, deletion), only that purpose takes it (any
other is refused as no longer valid, leaving the code as it was), and its
mail says what it would do ("to reset your account on learn.halkyon.eu: a
new password and new keys, and what was encrypted with the old ones is
lost") and to type it only in the app on that instance, nowhere else. The
app asks for each code with the purpose of its step.

Migration (module, Learn's and Todo's servers, Learn's device schema):
ALTER TABLE "email_code_request" ADD COLUMN "purpose" text; nullable,
so the requests of the last 15 minutes before it stay, taken by nothing
and forgotten within the hour.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_server/test/unit/code_mail_test.dart

@@ -95,21 +95,72 @@ void main() {
         language: 'en',
         app: 'Halkyon Learn',
         instance: 'learn.halkyon.eu',
+        purpose: EmailCodePurpose.signUp,
       );
 
       expect(mail.subject, 'K7QX-M2PD is your Halkyon Learn code');
       expect(mail.body, startsWith('K7QX-M2PD\n\n'));
-      expect(mail.body, contains('sign in on learn.halkyon.eu'));
+      expect(mail.body, contains('create your account on learn.halkyon.eu'));
       expect(mail.body, contains('15 minutes'));
       expect(mail.body, isNot(contains('http')));
     });
 
+    test('says what its code would do, and to type it nowhere but the app '
+        'on the instance, in each language', () {
+      ({String subject, String body}) mailFor(
+        EmailCodePurpose purpose,
+        String language,
+      ) => codeMail(
+        code: 'K7QX-M2PD',
+        language: language,
+        app: 'Halkyon Learn',
+        instance: 'learn.halkyon.eu',
+        purpose: purpose,
+      );
+      const english = {
+        EmailCodePurpose.signUp: 'to create your account',
+        EmailCodePurpose.finishSetup: 'to finish setting up your account',
+        EmailCodePurpose.authenticatorReset:
+            "to switch off your authenticator app's codes",
+        EmailCodePurpose.accountReset: 'to reset your account',
+        EmailCodePurpose.deletion: 'to delete your account',
+      };
+      const german = {
+        EmailCodePurpose.signUp: 'um dein Konto auf learn.halkyon.eu anzulegen',
+        EmailCodePurpose.finishSetup: 'um die Einrichtung deines Kontos',
+        EmailCodePurpose.authenticatorReset:
+            'um die Codes deiner Authenticator-App',
+        EmailCodePurpose.accountReset: 'zurückzusetzen',
+        EmailCodePurpose.deletion: 'mit allem darin zu löschen',
+      };
+      for (final purpose in EmailCodePurpose.values) {
+        final en = mailFor(purpose, 'en').body;
+        expect(en, contains(english[purpose]));
+        expect(
+          en,
+          contains('Type it only in Halkyon Learn on learn.halkyon.eu'),
+        );
+        expect(en, isNot(contains('sign in')));
+        final de = mailFor(purpose, 'de').body;
+        expect(de, contains(german[purpose]));
+        expect(
+          de,
+          contains('Gib ihn nur in Halkyon Learn auf learn.halkyon.eu'),
+        );
+      }
+      expect(
+        mailFor(EmailCodePurpose.accountReset, 'en').body,
+        contains('what was encrypted with the old ones is lost'),
+      );
+    });
+
     test('in German for German, in English for anything else', () {
       ({String subject, String body}) mailIn(String language) => codeMail(
         code: 'K7QX-M2PD',
         language: language,
         app: 'Halkyon Learn',
         instance: 'x',
+        purpose: EmailCodePurpose.signUp,
       );
 
       expect(mailIn('de').subject, 'K7QX-M2PD ist dein Halkyon-Learn-Code');
@@ -122,6 +173,7 @@ void main() {
         language: language,
         app: 'Halkyon Todo',
         instance: 'todo.example.org',
+        purpose: EmailCodePurpose.signUp,
       );
 
       expect(mailIn('en').subject, 'K7QX-M2PD is your Halkyon Todo code');
@@ -233,6 +285,7 @@ void main() {
           to: 'anna@example.org',
           code: 'K7QX-M2PD',
           language: 'de',
+          purpose: EmailCodePurpose.signUp,
         );
 
         expect(server.commands, contains('MAIL FROM:<learn@halkyon.eu>'));
@@ -242,7 +295,10 @@ void main() {
         expect(mail.headers, contains('<learn@halkyon.eu>'));
         expect(mail.headers, contains('text/plain'));
         expect(mail.body, startsWith('K7QX-M2PD'));
-        expect(mail.body, contains('auf learn.halkyon.eu anzumelden'));
+        expect(
+          mail.body,
+          contains('um dein Konto auf learn.halkyon.eu anzulegen'),
+        );
       },
     );
 
@@ -252,6 +308,7 @@ void main() {
           to: 'anna@example.org',
           code: 'K7QX-M2PD',
           language: 'en',
+          purpose: EmailCodePurpose.signUp,
         ),
         throwsA(isA<Exception>()),
       );