feat(app)!: no anonymous accounts on the device (ADR 0020, D4, D25)

Every account has a way in, so the apps make no anonymous account any
more. The start screen shows whenever nobody is signed in, a first
start included, and offers SimpleLogin, a password and GitHub for those
who have it, with no start without an account. An instance out of reach
is said so, with Try again, and one offering no way to create an account
too. An anonymous account's session left from before is deleted as the
app starts (D25), falling back to signing out on the device.

What only anonymous accounts needed goes: signing in anonymously, the
signed-out mark, adding GitHub to an account and switching to a GitHub
account from the Profile tab (with its Cancel, the only one), an
anonymous device's own keys, the warning that signing out deletes the
account, and the texts about keeping progress. Settings says on which
instance the account is signed in. Learn's publishing, reports and
suggestions and its learner count no longer ask whether the person has
an identity: everyone signed in has one.

The server still offers anonymous sign-in until the next commit, so
older apps keep working until v0.20.0 raises the minimum build.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

docs/adr/0020-sign-in-with-simplelogin.md

@@ -1,6 +1,6 @@
 # ADR 0020: Signing in with SimpleLogin only
 
-- **Status:** decided 23 Oct 2026, by the developer (D1–D20 below; D21–D24 on 24
+- **Status:** decided 23 Oct 2026, by the developer (D1–D20 below; D21–D28 on 24
   Oct), the *Proposal* with it (D15), as D18 to D20 change it and D24 drops the
   cut-off's machinery (D8's code, D10, D22, 10's `ANONYMOUS_SESSIONS_END`, 11, step 5).
 - **Built (23 Oct 2026), step 1:** the forwarding page (3),
@@ -71,7 +71,16 @@
   `SimpleLoginSection`, which reads it once where a `SimpleLoginStandingScope` is above
   it, as Learn's Profile has it for its first line and GitHub's button too. A cut-off
   day in the basics (`SIMPLELOGIN_REQUIRED_FROM`) with D22's banner was built and taken
-  out again before any release (D24).
+  out again before any release (D24). Then the apps' half of D25 (24 Oct, night): no
+  app makes an anonymous account. The start screen shows whenever nobody is signed in,
+  a first start included, and offers no start without an account. It says so when the
+  instance is out of reach (Try again), and when the instance offers no way to create
+  an account. An anonymous account's session left from before is deleted as the app
+  starts (`AuthRepository.endAnonymousSession`), so it goes at once rather than with
+  the next day's pruning. Where the instance can't be reached, the device only signs
+  it out. Adding GitHub, the Profile tab's GitHub sign-in with its Cancel, the
+  signed-out mark and an anonymous device's own keys went with it. The server's half
+  follows.
 - **Builds on:** ADR 0010 (email sign-in), ADR 0011 (profile pages), ADR 0016 (the
   register), ADR 0017 (a password, TOTP and the keys).
 - **Changes:** ADR 0017's way in on an instance that offers SimpleLogin (its keys, their
@@ -234,6 +243,24 @@ against app.simplelogin.io on 23 Oct:
   take them back from git (`f60d52e7` on `feat/simplelogin-sign-in` before it was
   amended). Anonymous accounts still go (D4) and handles are still required (D5): that
   is where the design ends, not a migration.
+- **D25 Anonymous accounts that exist are deleted** (24 Oct, night, recommended, over a
+  way to keep them until the developer has moved): the developer's own account isn't
+  anonymous. From the release on, an app signs an anonymous session out, and the
+  module's daily pruning deletes every anonymous person left, whatever their age,
+  through the same deletion as any account's (each service's own data with it). Nothing
+  turns an anonymous account into one with a way in any more: D23's anonymous half,
+  10's "until the cut-off", GitHub's upgrade, a password or SimpleLogin added to one.
+- **D26 No handle suggested at password sign-up** (24 Oct, night, recommended, over the
+  address's part before the @): the field starts empty and says whether the handle is
+  free as it is typed; a suggestion from the address would show part of it to everyone.
+- **D27 Removing a profile makes it private** (24 Oct, night, recommended, over
+  refusing it): the handle stays the account's, what is filled in goes (display name,
+  bio, links, avatar), and `/@handle` answers as for an unknown handle until the person
+  goes public again (D5). Once they have published something it is refused as before:
+  others refer to the handle.
+- **D28 No prompt for an account without a handle** (24 Oct, night, recommended, over a
+  step after signing in): the developer sets theirs in Profile; a handle is asked where
+  one is required and the account has none (a password added, the keys set).
 - **Also (23 Oct):** the developer's own account moves by adding SimpleLogin to it while
   signed in with GitHub; the instance's SimpleLogin app goes up for approval once
   halkyon.app/learn exists, before learn.halkyon.eu switches.