feat(app,learn,todo): the operator's "This instance" card, screen and badge (ADR 0021, step 1)

Whoever operates the instance approves, refuses and suspends accounts
and names other operators in the app (D21 to D24, D34):

- halkyon_app: InstanceOperatorRepository on
  ServerpodInstanceOperatorGateway (the module's instanceOperator
  endpoint; refusals as OperatorFailed: notFound, isOperator,
  lastOperator, notAllowed for 401 and 403, failed), in AppDependencies.
  OperatingCubit counts the accounts that wait: asked as the person's
  app opens, after every change, and every 5 minutes only while they
  operate the instance, so nobody else's app keeps asking.
  InstanceOperatorCard (or its tiles) and WaitingAccountsBadge show
  nothing at all for anyone else. InstanceOperatorScreen, laid out as
  Settings: the accounts that wait, each showing its four words to read
  out before Approve (D33), Refuse for new ones after asking; who
  operates, Take back after asking, the last always kept; Name an
  operator by handle; Find an account by the start of its handle, with
  Suspend after asking and Name as operator. English and German texts
  ("Admin" as the role word in German).
- Learn: the card right after the Sync card in Settings, which the
  cogs' count leads to as their dot leads to Sync; the count on the
  Settings cogs of Home and Profile.
- Todo: the tiles in the account sheet and the count on its button.
  Todo's server is a member, whose `operating()` is always null, so
  nothing shows there until it holds the register.

Tests: the gateway's mapping, the repository, both cubits with their
denials, the card, the badge and the screen; Learn's Settings shows the
card and the count to an operator and neither to anyone else.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_app/test/operator/data/instance_operator_repository_test.dart

@@ -0,0 +1,93 @@
+import 'package:flutter_test/flutter_test.dart';
+import 'package:halkyon_app/halkyon_app.dart';
+import 'package:halkyon_app/testing.dart';
+
+/// What the app's screens ask of the instance's operators' calls (Halkyon
+/// Learn's ADR 0021, D21 to D24), and the changes they say were made.
+void main() {
+  late FakeInstanceOperatorGateway gateway;
+  late InstanceOperatorRepository operators;
+
+  setUp(() {
+    gateway = FakeInstanceOperatorGateway()
+      ..operates = true
+      ..add(
+        OperatedAccount(
+          id: 'anna',
+          handle: 'anna',
+          since: DateTime.utc(2026, 10),
+          isOperator: true,
+        ),
+      )
+      ..add(
+        OperatedAccount(
+          id: 'ben',
+          handle: 'ben',
+          since: DateTime.utc(2026, 10, 24),
+          waitingSince: DateTime.utc(2026, 10, 24, 9),
+          words: const ['abandon', 'ability', 'able', 'about'],
+        ),
+      );
+    operators = InstanceOperatorRepository(gateway);
+    addTearDown(operators.dispose);
+  });
+
+  test('a handle is found and named with or without its @, and nothing '
+      'typed asks nothing', () async {
+    expect(
+      (await operators.accountsStartingWith(' @be ')).map((each) => each.id),
+      ['ben'],
+    );
+    expect(await operators.accountsStartingWith(' @ '), isEmpty);
+    await operators.appoint('@ben');
+
+    expect(gateway.calls, ['accounts be', 'appoint ben']);
+  });
+
+  test('every change says so, for the count to be asked anew; reading '
+      "doesn't", () async {
+    final changes = <void>[];
+    final listening = operators.changes.listen(changes.add);
+    addTearDown(listening.cancel);
+
+    await operators.waiting();
+    await operators.operators();
+    await operators.approve('ben');
+    await operators.suspend('ben');
+    await operators.approve('ben');
+    await operators.appoint('ben');
+    await pumpEventQueue();
+
+    expect(changes, hasLength(4));
+  });
+
+  test('a refused change says no change, and is refused', () async {
+    final changes = <void>[];
+    final listening = operators.changes.listen(changes.add);
+    addTearDown(listening.cancel);
+
+    await expectLater(
+      operators.takeBack('anna'),
+      throwsA(const OperatorFailed(OperatorProblem.lastOperator)),
+    );
+    await pumpEventQueue();
+
+    expect(changes, isEmpty);
+  });
+
+  test("someone who doesn't operate the instance is refused everything "
+      'but the question whether they do', () async {
+    gateway.operates = false;
+
+    expect(await operators.operating(), isNull);
+    await expectLater(
+      operators.waiting(),
+      throwsA(const OperatorFailed(OperatorProblem.notAllowed)),
+    );
+    await expectLater(
+      operators.approve('ben'),
+      throwsA(const OperatorFailed(OperatorProblem.notAllowed)),
+    );
+    expect(gateway.accounts['ben']!.waits, isTrue);
+  });
+}

packages/halkyon_app/test/operator/data/serverpod_instance_operator_gateway_test.dart

@@ -0,0 +1,200 @@
+import 'dart:convert';
+
+import 'package:flutter_test/flutter_test.dart';
+import 'package:halkyon_app/halkyon_app.dart';
+import 'package:halkyon_base_client/halkyon_base_client.dart';
+import 'package:http/http.dart' as http;
+import 'package:http/testing.dart';
+
+/// An instance's halkyon_base as the network shows it to an operator: two
+/// accounts, one waiting; or each call refuses as [refusals] says, by its
+/// endpoint and method.
+final class _Instance() {
+  static final anna = UuidValue.withValidation(
+    '0191f0c4-1111-7000-8000-000000000001',
+  );
+  static final ben = UuidValue.withValidation(
+    '0191f0c4-2222-7000-8000-000000000002',
+  );
+
+  /// What each call refuses with: an HTTP status, or the module's
+  /// exception.
+  final refusals = <String, Object>{};
+
+  /// What each call sent, by its endpoint and method.
+  final bodies = <String, String>{};
+
+  /// How many accounts wait; null as for someone who doesn't operate.
+  int? waiting = 1;
+
+  static final overviews = [
+    AccountOverview(
+      account: anna,
+      handle: 'anna',
+      since: DateTime.utc(2026, 10),
+      isOperator: true,
+      suspended: false,
+    ),
+    AccountOverview(
+      account: ben,
+      since: DateTime.utc(2026, 10, 24),
+      isOperator: false,
+      waitingSince: DateTime.utc(2026, 10, 24, 9),
+      words: ['abandon', 'ability', 'able', 'about'],
+      suspended: false,
+    ),
+  ];
+
+  http.Client client() => MockClient((request) async {
+    final call = request.url.path.substring(1);
+    bodies[call] = request.body;
+    if (refusals[call] case final refusal?) {
+      return switch (refusal) {
+        final int status => http.Response('', status),
+        final OperatorRefusedException refused => http.Response(
+          jsonEncode({
+            'className': 'halkyon_base.OperatorRefusedException',
+            'data': refused.toJson(),
+          }),
+          400,
+        ),
+        _ => throw ArgumentError.value(refusal),
+      };
+    }
+    return switch (call) {
+      'halkyon_base.account/operating' => http.Response(
+        jsonEncode(waiting),
+        200,
+      ),
+      'halkyon_base.instanceOperator/waiting' ||
+      'halkyon_base.instanceOperator/accounts' ||
+      'halkyon_base.instanceOperator/operators' => http.Response(
+        jsonEncode([for (final each in overviews) each.toJson()]),
+        200,
+      ),
+      'halkyon_base.instanceOperator/approve' ||
+      'halkyon_base.instanceOperator/refuse' ||
+      'halkyon_base.instanceOperator/suspend' ||
+      'halkyon_base.instanceOperator/appoint' ||
+      'halkyon_base.instanceOperator/takeBack' => http.Response('null', 200),
+      _ => http.Response('', 404),
+    };
+  });
+}
+
+Matcher failsWith(OperatorProblem problem) => throwsA(OperatorFailed(problem));
+
+/// What an operator's app asks of the module (Halkyon Learn's ADR 0021,
+/// D21 to D24, D34), and its refusals in the app's terms.
+void main() {
+  late _Instance instance;
+  late BaseClient app;
+  late ServerpodInstanceOperatorGateway gateway;
+
+  setUp(() {
+    instance = _Instance();
+    app = BaseClient(
+      'https://learn.example.org/',
+      httpClientOverride: instance.client(),
+    );
+    gateway = ServerpodInstanceOperatorGateway(app.modules);
+    addTearDown(app.close);
+  });
+
+  test('counts the accounts that wait; null for someone who operates '
+      'nothing', () async {
+    expect(await gateway.operating(), 1);
+
+    instance.waiting = null;
+    expect(await gateway.operating(), isNull);
+  });
+
+  test('reads accounts as the instance knows them, words while they wait, '
+      'and never more', () async {
+    final waiting = await gateway.waiting();
+
+    expect(waiting, [
+      OperatedAccount(
+        id: '${_Instance.anna}',
+        handle: 'anna',
+        since: DateTime.utc(2026, 10),
+        isOperator: true,
+      ),
+      OperatedAccount(
+        id: '${_Instance.ben}',
+        since: DateTime.utc(2026, 10, 24),
+        waitingSince: DateTime.utc(2026, 10, 24, 9),
+        words: const ['abandon', 'ability', 'able', 'about'],
+      ),
+    ]);
+    expect(waiting.last.waits, isTrue);
+    expect(waiting.first.waits, isFalse);
+    expect(await gateway.operators(), waiting);
+    expect(await gateway.accountsStartingWith('an'), waiting);
+    expect(
+      jsonDecode(instance.bodies['halkyon_base.instanceOperator/accounts']!),
+      {'startingWith': 'an'},
+    );
+  });
+
+  test('names accounts by their ID, and an operator to be by handle', () async {
+    final ben = '${_Instance.ben}';
+    await gateway.approve(ben);
+    await gateway.refuse(ben);
+    await gateway.suspend(ben);
+    await gateway.takeBack(ben);
+    await gateway.appoint('ben');
+
+    for (final call in ['approve', 'refuse', 'suspend', 'takeBack']) {
+      expect(
+        jsonDecode(instance.bodies['halkyon_base.instanceOperator/$call']!),
+        {'account': ben},
+        reason: call,
+      );
+    }
+    expect(
+      jsonDecode(instance.bodies['halkyon_base.instanceOperator/appoint']!),
+      {'handle': 'ben'},
+    );
+  });
+
+  test("an account ID that isn't one fails, and nothing is sent", () async {
+    await expectLater(
+      gateway.approve('ben'),
+      failsWith(OperatorProblem.failed),
+    );
+    expect(instance.bodies, isEmpty);
+  });
+
+  test("the instance's refusals, in the app's terms", () async {
+    for (final (refusal, problem) in [
+      (OperatorRefusal.notFound, OperatorProblem.notFound),
+      (OperatorRefusal.isOperator, OperatorProblem.isOperator),
+      (OperatorRefusal.lastOperator, OperatorProblem.lastOperator),
+    ]) {
+      instance.refusals['halkyon_base.instanceOperator/suspend'] =
+          OperatorRefusedException(reason: refusal);
+      await expectLater(
+        gateway.suspend('${_Instance.ben}'),
+        failsWith(problem),
+      );
+    }
+  });
+
+  test("someone who doesn't operate the instance, or no longer, is not "
+      'allowed: without the scope, or without a session', () async {
+    instance.refusals['halkyon_base.instanceOperator/waiting'] = 403;
+    await expectLater(gateway.waiting(), failsWith(OperatorProblem.notAllowed));
+
+    instance.refusals['halkyon_base.instanceOperator/waiting'] = 401;
+    await expectLater(gateway.waiting(), failsWith(OperatorProblem.notAllowed));
+  });
+
+  test('an instance out of reach or failing fails, and says no more', () async {
+    instance.refusals['halkyon_base.instanceOperator/approve'] = 500;
+    await expectLater(
+      gateway.approve('${_Instance.ben}'),
+      failsWith(OperatorProblem.failed),
+    );
+  });
+}