fix(auth): GitHub-only accounts go at GitHub's end; only the anonymous add an address

The full reading's M1 and L6: once GitHub IDs were forgotten at
GITHUB_SIGN_IN_ENDS, an account that had signed in with GitHub alone
counted as anonymous, so a stolen session and any mailbox gave it a first
password and authenticator; and such accounts, with no way in left, were
never pruned. Now:

- at the end, the daily run that forgets the GitHub IDs first deletes the
  accounts that sign in with GitHub alone (no address, so never a
  password), with everything they have, members told (deletePerson); the
  app tells them for the three months before that their account goes then
  unless they set up a password (passwordSectionGitHubEndsDeletes, en/de);
- password.set adds an address without GitHub only for someone anonymous
  where the session lives (anonymousHere, which a member tells the
  register, as it tells freshGitHubSignIn); anyone else is refused before
  any code is used.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_server/test/integration/auth/github_test.dart

@@ -234,6 +234,35 @@ void main() {
         });
         expect(await forgetGitHubAccounts(session, now: ends), 1);
         expect(await GitHubAccount.db.count(session), 0);
+        // Ben signed in with GitHub alone and never set a password up: his
+        // account goes with it (the full reading's M1), no way in left.
+        expect(await AuthUser.db.findById(session, ben), isNull);
+      });
+
+      test('at its end keeps the account of someone with an address too, '
+          'forgetting only the GitHub ID', () async {
+        final carl = (await AuthServices.instance.authUsers.create(
+          session,
+          scopes: {identified},
+        )).id;
+        await GitHubAccount.db.insertRow(
+          session,
+          GitHubAccount(userIdentifier: '3003', authUserId: carl),
+        );
+        await EmailIdentity.db.insertRow(
+          session,
+          EmailIdentity(
+            authUserId: carl,
+            addressHash: addressHash(session.serverpod, 'carl@example.org'),
+            createdAt: DateTime.utc(2026, 10),
+          ),
+        );
+        final ends = DateTime.utc(2027, 1, 22);
+        useGitHubSignInEnds(session.serverpod, ends);
+        expect(await forgetGitHubAccounts(session, now: ends), 2);
+        expect(await AuthUser.db.findById(session, carl), isNotNull);
+        expect(await AuthUser.db.findById(session, ben), isNull);
+        expect(await GitHubAccount.db.count(session), 0);
       });
     });
   });