feat(base,app)!: GitHub signs nobody in any more (ADR 0020, D36)

Every account signs in with SimpleLogin or a password now, so GitHub
goes from the module, the shared app package, Learn and Todo, ahead of
ADR 0017's GITHUB_SIGN_IN_ENDS.

- halkyon_base: no `gitHubSignIn` endpoint, GitHub identity provider or
  GitHub refusals; no `githubClientId`/`githubClientSecret`, no
  `GITHUB_SIGN_IN_ENDS` and no `forgetGitHubAccounts`; the register
  loses `account-with-github`. `SignInWays.gitHub`, the basics'
  `gitHubClientId` and `gitHubSignInEnds`, and `PasswordRefusal`'s
  `signInAgain` and `noAddress` go. A first password takes a code
  mailed to the person's own address; an account without one sets none
  (`wrongCredentials`).
- Learn's server: `instance.info()` without `gitHubClientId`, the
  pruning without GitHub, and `minimumAppBuild` 24, as builds up to 23
  (v0.20.0) require `SignInWays.gitHub`: the server deploys with the
  release of build 24.
- halkyon_app: no GitHub button or problems on the start screen, no
  password offered after a GitHub sign-in, and `ServerpodAuthGateway`
  without the browser half only GitHub used (`(client, base:)`). The
  account section offers a first password only to an account with an
  address. `LoopbackWebAuth` and the apps' schemes stay, SimpleLogin's
  ways back.
- Learn's Profile lists no GitHub; the texts go (English, German).
- Serverpod's `serverpod_auth_idp_github_account` stays, as its
  migrations make it; a row goes with its account, and ADR 0020's D36
  gives operators the SQL to delete those left.
- deploy/: compose.yaml and .env.example without GitHub. The READMEs,
  AGENTS.md files and ADR 0017 amended.

BREAKING CHANGE: builds up to 23 can't read the instance's answers
about an account's ways in; minimumAppBuild is 24.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_app/test/password/bloc/account_setup_cubit_test.dart

@@ -42,7 +42,6 @@ void main() {
   AccountSetupCubit setUpAs(
     AccountSetupMode mode, {
     String? address,
-    bool hasAddress = false,
     bool hasHandle = false,
     String? phrase,
   }) {
@@ -51,7 +50,6 @@ void main() {
       mode: mode,
       language: 'en',
       address: address,
-      hasAddress: hasAddress,
       hasHandle: hasHandle,
       phrase: phrase,
     );
@@ -239,11 +237,19 @@ void main() {
     expect(auth.status, const SignedOut());
   });
 
-  test('gives one signed in with GitHub a password with an address a code '
-      'proves, the session staying theirs (ADR 0017, D2), and their first '
+  /// Signs in the person of an account at [address] without a password,
+  /// as codes by mail left accounts; their id.
+  Future<String> signedInWithAddress(String address) async {
+    final person = gateway.addAddressOnly(address).person;
+    await auth.useSession(SessionGrant(person, 'session-1'));
+    return person;
+  }
+
+  test('gives a signed-in person with an address a password, a code mailed '
+      'there proving them, the session staying theirs, and their first '
       'handle (ADR 0020, D28)', () async {
-    await auth.switchToGitHub();
-    final person = (auth.status as SignedIn).authUserId;
+    final person = await signedInWithAddress('anna@example.org');
+    // The device doesn't know the address: it asks for it.
     final cubit = setUpAs(AccountSetupMode.setPassword)
       ..addressEntered('anna@example.org');
     await cubit.passwordEntered('correct horse', 'correct horse');
@@ -255,6 +261,7 @@ void main() {
     expect(gateway.calls.last, 'checkHandle');
     cubit.handleEntered('anna');
     expect(cubit.state, at(AccountSetupStep.mailCode));
+    expect(gateway.mailed.last.purpose, MailCodePurpose.firstPassword);
 
     await cubit.mailCodeEntered(gateway.codeFor('anna@example.org'));
     await cubit.authenticatorCodeEntered(fakeTotpCode);
@@ -268,8 +275,7 @@ void main() {
 
   test('asks no handle of a signed-in person who has one, and sends '
       'none', () async {
-    await auth.switchToGitHub();
-    final person = (auth.status as SignedIn).authUserId;
+    final person = await signedInWithAddress('anna@example.org');
     gateway.handles[person] = 'anna';
     final cubit = setUpAs(AccountSetupMode.setPassword, hasHandle: true)
       ..addressEntered('anna@example.org');
@@ -283,27 +289,14 @@ void main() {
     expect(gateway.handles[person], 'anna');
   });
 
-  test('gives a signed-in person with an address their first password only '
-      'with a code mailed to that address for it, never with the session '
-      'alone (the fourth reading)', () async {
-    await auth.switchToGitHub();
-    final person = (auth.status as SignedIn).authUserId;
-    final first = setUpAs(AccountSetupMode.setPassword)
-      ..addressEntered('anna@example.org');
-    await first.passwordEntered('correct horse', 'correct horse');
-    first.phraseWrittenDown();
-    await first.phraseChecked(wordsAsked(first.state));
-    first.handleEntered('anna');
-    await first.mailCodeEntered(gateway.codeFor('anna@example.org'));
-    // An address and no password, as codes by mail left accounts.
-    gateway.accountOf(person)
-      ..password = null
-      ..authenticators.clear();
+  test('where the device knows the address, starts at the password and '
+      'mails the code there for a first password', () async {
+    final person = await signedInWithAddress('anna@example.org');
+    gateway.handles[person] = 'anna';
 
     final cubit = setUpAs(
       AccountSetupMode.setPassword,
       address: 'anna@example.org',
-      hasAddress: true,
       hasHandle: true,
     );
     expect(cubit.state, at(AccountSetupStep.password));
@@ -320,43 +313,40 @@ void main() {
 
   test('asks for the address a signed-in person has where the device '
       "doesn't know it", () {
-    final cubit = setUpAs(AccountSetupMode.setPassword, hasAddress: true);
+    final cubit = setUpAs(AccountSetupMode.setPassword);
     expect(cubit.state, at(AccountSetupStep.address));
   });
 
-  test('asks GitHub people to sign in with GitHub again where theirs is '
-      'too old, keeping the code for after', () async {
-    await auth.switchToGitHub();
-    gateway
-      ..gitHubPeople.add('github-person')
-      ..staleGitHubSignIns.add('github-person');
+  test('refuses a password to a signed-in person without an address, '
+      'whatever address they type: a code mailed to their own is the only '
+      'proof (ADR 0020, D36)', () async {
+    // Someone with no account at an address, as GitHub alone left them.
+    await auth.useSession(const SessionGrant('person-1', 'session-1'));
     final cubit = setUpAs(AccountSetupMode.setPassword)
       ..addressEntered('gina@example.org');
     await cubit.passwordEntered('correct horse', 'correct horse');
     cubit.phraseWrittenDown();
     await cubit.phraseChecked(wordsAsked(cubit.state));
     cubit.handleEntered('gina');
-    final code = gateway.codeFor('gina@example.org');
 
-    await cubit.mailCodeEntered(code);
+    await cubit.mailCodeEntered(gateway.codeFor('gina@example.org'));
+
     expect(
       cubit.state,
-      at(AccountSetupStep.mailCode, problem: PasswordProblem.signInAgain),
+      at(AccountSetupStep.mailCode, problem: PasswordProblem.wrongCredentials),
     );
-
-    gateway.staleGitHubSignIns.clear();
-    await cubit.mailCodeEntered(code);
-    expect(cubit.state, at(AccountSetupStep.authenticator));
+    expect(gateway.accounts, isEmpty);
+    expect(gateway.handles, isEmpty);
   });
 
-  test("refuses another account's address to a signed-in person, back at "
-      'the address', () async {
+  test('refuses another address than their own to a signed-in person, back '
+      'at the address', () async {
     gateway.addAccount(
       'anna@example.org',
       password: 'correct horse',
       crypto: crypto,
     );
-    await auth.switchToGitHub();
+    final person = await signedInWithAddress('ben@example.org');
     final cubit = setUpAs(AccountSetupMode.setPassword)
       ..addressEntered('anna@example.org');
     await cubit.passwordEntered('another horse', 'another horse');
@@ -368,8 +358,9 @@ void main() {
 
     expect(
       cubit.state,
-      at(AccountSetupStep.address, problem: PasswordProblem.addressTaken),
+      at(AccountSetupStep.address, problem: PasswordProblem.otherAddressLinked),
     );
+    expect(gateway.accountOf(person).password, isNull);
   });
 
   group("finishing an account's reset", () {

packages/halkyon_app/test/password/bloc/unexpected_failures_test.dart

@@ -34,7 +34,7 @@ class _BrokenCrypto() extends FakeAccountCrypto {
 /// A gateway failing as nothing above expects.
 class _BrokenGateway(super.auth) extends FakePasswordGateway {
   @override
-  Future<({bool offered, DateTime? gitHubEnds})> offers() async =>
+  Future<bool> offers() async =>
       throw const FormatException('an answer no client reads');
 }
 
@@ -135,7 +135,7 @@ void main() {
     final gateway = _BrokenGateway(auth);
     final broken = repository(gateway: gateway, crypto: FakeAccountCrypto());
     addTearDown(broken.dispose);
-    await auth.switchToGitHub();
+    auth.signIn('ada');
     final section = AccountSecurityCubit(broken);
     addTearDown(section.close);
     final states = await statesOf(section, section.load);