fix(auth): GitHub-only accounts go at GitHub's end; only the anonymous add an address

The full reading's M1 and L6: once GitHub IDs were forgotten at
GITHUB_SIGN_IN_ENDS, an account that had signed in with GitHub alone
counted as anonymous, so a stolen session and any mailbox gave it a first
password and authenticator; and such accounts, with no way in left, were
never pruned. Now:

- at the end, the daily run that forgets the GitHub IDs first deletes the
  accounts that sign in with GitHub alone (no address, so never a
  password), with everything they have, members told (deletePerson); the
  app tells them for the three months before that their account goes then
  unless they set up a password (passwordSectionGitHubEndsDeletes, en/de);
- password.set adds an address without GitHub only for someone anonymous
  where the session lives (anonymousHere, which a member tells the
  register, as it tells freshGitHubSignIn); anyone else is refused before
  any code is used.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_server/test/integration/password/password_test.dart

@@ -380,6 +380,43 @@ void main() {
           });
         });
 
+        test('is refused to someone neither anonymous nor with a way in (a '
+            'GitHub ID forgotten): a session alone and a code to any address '
+            'set nothing', () async {
+          // Anna, identified, her GitHub ID forgotten (the full reading's
+          // M1): a session of hers, stolen, outlived it.
+          await grantIdentified(session, anna);
+          await AnonymousAccount.db.deleteWhere(
+            session,
+            where: (t) => t.authUserId.equals(anna),
+          );
+          final thief = await PasswordDevice.make(seed: 99);
+          final code = await mailedCode('thief@example.org');
+          await expectLater(
+            endpoints.password.set(
+              asAnna(),
+              setup: thief.setup(),
+              request: code.request,
+              code: code.code,
+            ),
+            refused(PasswordRefusal.wrongCredentials),
+          );
+          expect(
+            await EmailIdentity.db.count(
+              session,
+              where: (t) => t.authUserId.equals(anna),
+            ),
+            0,
+          );
+          expect(
+            await AccountPassword.db.count(
+              session,
+              where: (t) => t.authUserId.equals(anna),
+            ),
+            0,
+          );
+        });
+
         test('is refused without an address, keeping nothing', () async {
           await expectLater(
             endpoints.password.set(asAnna(), setup: device.setup()),