fix(auth): GitHub-only accounts go at GitHub's end; only the anonymous add an address

The full reading's M1 and L6: once GitHub IDs were forgotten at
GITHUB_SIGN_IN_ENDS, an account that had signed in with GitHub alone
counted as anonymous, so a stolen session and any mailbox gave it a first
password and authenticator; and such accounts, with no way in left, were
never pruned. Now:

- at the end, the daily run that forgets the GitHub IDs first deletes the
  accounts that sign in with GitHub alone (no address, so never a
  password), with everything they have, members told (deletePerson); the
  app tells them for the three months before that their account goes then
  unless they set up a password (passwordSectionGitHubEndsDeletes, en/de);
- password.set adds an address without GitHub only for someone anonymous
  where the session lives (anonymousHere, which a member tells the
  register, as it tells freshGitHubSignIn); anyone else is refused before
  any code is used.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_app/lib/l10n/halkyon_app_de.arb

@@ -231,5 +231,6 @@
   "passwordResetsAccount": "Am {date} bekommt dein Konto ein neues Passwort und neue Schlüssel, und was mit den alten verschlüsselt ist, geht verloren: Jemand hat es mit einem Code per Mail angefordert. Warst du das nicht, sag es ab.",
   "passwordResetsCallOff": "Absagen",
   "passwordCallOffTitle": "Zurücksetzen absagen",
-  "passwordCallOffIntro": "Dein Passwort und ein Code sagen jedes anstehende Zurücksetzen ab."
+  "passwordCallOffIntro": "Dein Passwort und ein Code sagen jedes anstehende Zurücksetzen ab.",
+  "passwordSectionGitHubEndsDeletes": "Die Anmeldung mit GitHub endet am {date}. Dann wird dein Konto mit allem darin gelöscht, es sei denn, du richtest vorher ein Passwort ein."
 }

packages/halkyon_app/lib/l10n/halkyon_app_en.arb

@@ -499,5 +499,13 @@
   },
   "passwordResetsCallOff": "Call it off",
   "passwordCallOffTitle": "Call off the reset",
-  "passwordCallOffIntro": "Your password and a code call off every reset waiting."
+  "passwordCallOffIntro": "Your password and a code call off every reset waiting.",
+  "passwordSectionGitHubEndsDeletes": "Sign-in with GitHub ends on {date}. Your account, with everything in it, will be deleted then, unless you set up a password before.",
+  "@passwordSectionGitHubEndsDeletes": {
+    "placeholders": {
+      "date": {
+        "type": "String"
+      }
+    }
+  }
 }

packages/halkyon_app/lib/l10n/halkyon_app_localizations.dart

@@ -1494,6 +1494,12 @@ abstract class HalkyonAppLocalizations {
   /// In en, this message translates to:
   /// **'Your password and a code call off every reset waiting.'**
   String get passwordCallOffIntro;
+
+  /// No description provided for @passwordSectionGitHubEndsDeletes.
+  ///
+  /// In en, this message translates to:
+  /// **'Sign-in with GitHub ends on {date}. Your account, with everything in it, will be deleted then, unless you set up a password before.'**
+  String passwordSectionGitHubEndsDeletes(String date);
 }
 
 class _HalkyonAppLocalizationsDelegate

packages/halkyon_app/lib/l10n/halkyon_app_localizations_de.dart

@@ -869,4 +869,9 @@ class HalkyonAppLocalizationsDe extends HalkyonAppLocalizations {
   @override
   String get passwordCallOffIntro =>
       'Dein Passwort und ein Code sagen jedes anstehende Zurücksetzen ab.';
+
+  @override
+  String passwordSectionGitHubEndsDeletes(String date) {
+    return 'Die Anmeldung mit GitHub endet am $date. Dann wird dein Konto mit allem darin gelöscht, es sei denn, du richtest vorher ein Passwort ein.';
+  }
 }

packages/halkyon_app/lib/l10n/halkyon_app_localizations_en.dart

@@ -852,6 +852,11 @@ class HalkyonAppLocalizationsEn extends HalkyonAppLocalizations {
   @override
   String get passwordCallOffIntro =>
       'Your password and a code call off every reset waiting.';
+
+  @override
+  String passwordSectionGitHubEndsDeletes(String date) {
+    return 'Sign-in with GitHub ends on $date. Your account, with everything in it, will be deleted then, unless you set up a password before.';
+  }
 }
 
 /// The translations for English, as used in the United Kingdom (`en_GB`).

packages/halkyon_app/lib/src/auth/widget/session_gate.dart

@@ -166,9 +166,12 @@ class _PasswordOfferState() extends State<_PasswordOffer> {
                     ),
                     const SizedBox(height: 12),
                     Text(switch (security.gitHubEnds) {
-                      final ends? => l10n.passwordSectionGitHubEnds(
-                        passwordMoment(context, ends),
-                      ),
+                      final ends? =>
+                        (security.hasAddress
+                            ? l10n.passwordSectionGitHubEnds
+                            : l10n.passwordSectionGitHubEndsDeletes)(
+                          passwordMoment(context, ends),
+                        ),
                       null => l10n.passwordOfferBody,
                     }),
                     const SizedBox(height: 24),

packages/halkyon_app/lib/src/password/widget/account_security_section.dart

@@ -76,7 +76,11 @@ class const _AccountSecurity() extends StatelessWidget {
           Padding(
             padding: const EdgeInsets.only(top: 8),
             child: Text(
-              l10n.passwordSectionGitHubEnds(
+              // Without an address, nothing is left to sign in with: the
+              // account goes at the end (the full reading's M1).
+              (security.hasAddress
+                  ? l10n.passwordSectionGitHubEnds
+                  : l10n.passwordSectionGitHubEndsDeletes)(
                 passwordMoment(context, security.gitHubEnds!),
               ),
               style: theme.textTheme.bodyMedium?.copyWith(