docs(auth): GitHub is offered to nobody where passwords are (ADR 0017)

ADR 0017's rules as they stand, halkyon_app's README and Learn's
AGENTS.md: where an instance offers passwords, the apps offer no Add GitHub
and no hint on adding it, an anonymous person's Sign in with GitHub reaches
only the account someone has, and every refusal says why.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

docs/adr/0017-password-totp-and-keys.md

@@ -684,7 +684,10 @@ Every reset carried out, and every new password (a setup's replaced too), ends t
 account's sessions in every service (a change keeps the session asking). A session ended
 for ten wrong proofs leaves its owner a warning; a session made since dismisses it, and a
 new password clears it. 30 days after GitHub's end, accounts that sign in with GitHub
-alone go, on the register. A member ends the sessions an account had on it before the
+alone go, on the register. Where passwords are offered, GitHub is added to nobody, and
+the apps offer it to nobody: an anonymous person's Sign in with GitHub reaches only the
+account someone has (linking names it taken before refusing), and every refusal says
+why (`usePassword`, `deprecated`, `ended`; found in the end-to-end trial). A member ends the sessions an account had on it before the
 register's moment by its own clock, but the one a reset signed in there, and deletes no
 account while the register is out of reach. On the device nothing secret is copied
 (the phrase typed back is pasted, never copied out), and a saved file is the own user's