fix(auth): GitHub-only accounts go at GitHub's end; only the anonymous add an address

The full reading's M1 and L6: once GitHub IDs were forgotten at
GITHUB_SIGN_IN_ENDS, an account that had signed in with GitHub alone
counted as anonymous, so a stolen session and any mailbox gave it a first
password and authenticator; and such accounts, with no way in left, were
never pruned. Now:

- at the end, the daily run that forgets the GitHub IDs first deletes the
  accounts that sign in with GitHub alone (no address, so never a
  password), with everything they have, members told (deletePerson); the
  app tells them for the three months before that their account goes then
  unless they set up a password (passwordSectionGitHubEndsDeletes, en/de);
- password.set adds an address without GitHub only for someone anonymous
  where the session lives (anonymousHere, which a member tells the
  register, as it tells freshGitHubSignIn); anyone else is refused before
  any code is used.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_server/test/integration/register/register_test.dart

@@ -384,6 +384,7 @@ void main() {
             remote.setPassword(
               session,
               person: annaOnTodo,
+              anonymousHere: true,
               setup: device.setup(),
               request: request,
               code: 'AAAA-AAAA',
@@ -391,9 +392,22 @@ void main() {
             refused(EmailSignInRefusal.wrongCode),
           );
           expect(await AuthUser.db.findById(session, annaOnTodo), isNull);
+          // Without the member saying Anna is anonymous there, refused
+          // before her code is used (the full reading's M1).
+          await expectLater(
+            remote.setPassword(
+              session,
+              person: annaOnTodo,
+              setup: device.setup(),
+              request: request,
+              code: mailbox.codeFor('anna@example.org'),
+            ),
+            refused(PasswordRefusal.wrongCredentials),
+          );
           await remote.setPassword(
             session,
             person: annaOnTodo,
+            anonymousHere: true,
             setup: device.setup(),
             request: request,
             code: mailbox.codeFor('anna@example.org'),
@@ -486,6 +500,7 @@ void main() {
             await remote.setPassword(
               session,
               person: annaOnTodo,
+              anonymousHere: true,
               setup: device.setup(),
               request: request,
               code: mailbox.codeFor('anna@example.org'),
@@ -755,6 +770,7 @@ void main() {
               await remote.setPassword(
                 session,
                 person: annaOnTodo,
+                anonymousHere: true,
                 setup: device.setup(),
                 request: request,
                 code: mailbox.codeFor('anna@example.org'),