feat(base,app)!: GitHub signs nobody in any more (ADR 0020, D36)

Every account signs in with SimpleLogin or a password now, so GitHub
goes from the module, the shared app package, Learn and Todo, ahead of
ADR 0017's GITHUB_SIGN_IN_ENDS.

- halkyon_base: no `gitHubSignIn` endpoint, GitHub identity provider or
  GitHub refusals; no `githubClientId`/`githubClientSecret`, no
  `GITHUB_SIGN_IN_ENDS` and no `forgetGitHubAccounts`; the register
  loses `account-with-github`. `SignInWays.gitHub`, the basics'
  `gitHubClientId` and `gitHubSignInEnds`, and `PasswordRefusal`'s
  `signInAgain` and `noAddress` go. A first password takes a code
  mailed to the person's own address; an account without one sets none
  (`wrongCredentials`).
- Learn's server: `instance.info()` without `gitHubClientId`, the
  pruning without GitHub, and `minimumAppBuild` 24, as builds up to 23
  (v0.20.0) require `SignInWays.gitHub`: the server deploys with the
  release of build 24.
- halkyon_app: no GitHub button or problems on the start screen, no
  password offered after a GitHub sign-in, and `ServerpodAuthGateway`
  without the browser half only GitHub used (`(client, base:)`). The
  account section offers a first password only to an account with an
  address. `LoopbackWebAuth` and the apps' schemes stay, SimpleLogin's
  ways back.
- Learn's Profile lists no GitHub; the texts go (English, German).
- Serverpod's `serverpod_auth_idp_github_account` stays, as its
  migrations make it; a row goes with its account, and ADR 0020's D36
  gives operators the SQL to delete those left.
- deploy/: compose.yaml and .env.example without GitHub. The READMEs,
  AGENTS.md files and ADR 0017 amended.

BREAKING CHANGE: builds up to 23 can't read the instance's answers
about an account's ways in; minimumAppBuild is 24.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

docs/adr/0020-sign-in-with-simplelogin.md

@@ -1,8 +1,9 @@
 # ADR 0020: Signing in with SimpleLogin only
 
 - **Status:** decided 23 Oct 2026, by the developer (D1–D20 below; D21–D35 on 24
-  Oct), the *Proposal* with it (D15), as D18 to D20 change it and D24 drops the
-  cut-off's machinery (D8's code, D10, D22, 10's `ANONYMOUS_SESSIONS_END`, 11, step 5).
+  Oct, D36 on 25 Oct), the *Proposal* with it (D15), as D18 to D20 change it, D24 drops
+  the cut-off's machinery (D8's code, D10, D22, 10's `ANONYMOUS_SESSIONS_END`, 11, step
+  5) and D36 takes GitHub out of the apps and the instances.
 - **Built (23 Oct 2026), step 1:** the forwarding page (3),
   `/simplelogin-callback` on the register's web server (halkyon_base's
   `addSimpleLoginCallbackRoute`, Caddy forwarding the path), ahead of the sign-in, so
@@ -365,6 +366,49 @@ against app.simplelogin.io on 23 Oct:
   owner sees only on opening it, and over the home alone): at the top of the home,
   where an app too old for its instance shows, and under the SimpleLogin row, each with
   Call it off.
+- **D36 GitHub goes from the apps and the instances** (25 Oct, the developer: "Can we
+  now purge GitHub from the application and server?", once their account signed in
+  with SimpleLogin on both their devices and learn.halkyon.eu's `deploy/.env` held
+  GitHub's OAuth app no more; over keeping it until ADR 0017's D2 ended it on
+  `GITHUB_SIGN_IN_ENDS`, 22 Jan 2027, which D24 had left in place): nothing signs in
+  with GitHub. halkyon_base loses the `gitHubSignIn` endpoint with its refusals, the
+  GitHub identity provider, `githubClientId` and `githubClientSecret`,
+  `GITHUB_SIGN_IN_ENDS` and the pruning that forgot GitHub IDs after it
+  (`forgetGitHubAccounts`), the register's `account-with-github`, the basics'
+  `gitHubClientId` and `gitHubSignInEnds` (Learn's `instance.info()` its
+  `gitHubClientId`), `SignInWays.gitHub`, and `PasswordRefusal`'s `signInAgain` and
+  `noAddress`. A first password takes a code mailed to the person's own address, so an
+  account without one (SimpleLogin's alone, or one with a GitHub ID left) sets none
+  (`wrongCredentials`), and the account section offers it none. halkyon_app loses the
+  start screen's GitHub button and its problems, the password offered right after a
+  GitHub sign-in, and `ServerpodAuthGateway`'s browser half, which only GitHub used;
+  `LoopbackWebAuth` and the apps' schemes stay, SimpleLogin's ways back.
+  - **`minimumAppBuild` 24** (recommended, over keeping `SignInWays.gitHub` as a field
+    always false so that build 23 goes on working): builds up to 23 (v0.20.0) require
+    the field, so the server without it deploys with the release of build 24, as the
+    module's did with build 21.
+  - **The IDs left are the operator's to delete** (recommended, over a migration
+    deleting them, which would run on every instance whether its people had moved or
+    not, and over a step of the pruning): Serverpod's `serverpod_auth_idp_github_account`
+    stays as Serverpod's migrations make it (dropping it would set the module's
+    migrations against Serverpod's), and a row goes with its account (`ON DELETE
+    CASCADE`). An account GitHub alone signed in has no way in any more: the first query
+    lists them, the second deletes every ID (on learn.halkyon.eu through `docker compose
+    exec -T postgres psql -U halkyon_learn -d halkyon_learn`). The backups keep the IDs
+    until their snapshots roll over, three months at most (`deploy/backups.md`).
+
+    ```sql
+    -- The people GitHub alone signed in: no SimpleLogin, no address.
+    SELECT g."authUserId" FROM "serverpod_auth_idp_github_account" g
+    WHERE NOT EXISTS (SELECT 1 FROM "halkyon_oidc_identity" o
+                      WHERE o."authUserId" = g."authUserId")
+      AND NOT EXISTS (SELECT 1 FROM "email_identity" e
+                      WHERE e."authUserId" = g."authUserId");
+    -- Then every GitHub ID: nothing reads them any more.
+    DELETE FROM "serverpod_auth_idp_github_account";
+    ```
+
+  - **Released with the next changes** (over a release of its own).
 - **Also (23 Oct):** the developer's own account moves by adding SimpleLogin to it while
   signed in with GitHub; the instance's SimpleLogin app goes up for approval once
   halkyon.app/learn exists, before learn.halkyon.eu switches.