feat(app): a wait screen for accounts that wait for the operator (ADR 0021, step 1)

An account signed in or up to on an instance whose operator approves
new accounts, or one suspended, gets no session but a wait: the device
keeps its pass, words and handle in the keyring per instance
(SecureAccountWaitStore, InstanceStorage.waitOf), the auth status is
Waiting, and SessionGate shows WaitScreen in its own app, so the start
screen's sheets go with it. Every sign-in flow hands over to it: the
password's sign-in, sign-up, reset and account reset, SimpleLogin's
sign-in, sign-up and mending; their cubits show no problem then.

The wait screen shows the handle, the four words the operator reads out
for the person to match, and that Halkyon never asks anyone to read them
out (D33); it asks where the wait stands as it opens, every 30 seconds,
as the app comes back and when asked. A new account can be deleted with
its pass, a suspended one can't (ADR 0017). Approved, it leads to the
usual sign-in, once more as before (D31); a pass the instance knows no
more ends the wait. The start screen says where new accounts wait for
approval, and offers no Create an account where the operator takes none;
both refusals (closed, too many waiting) have their words, en and de.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_app/test/password/bloc/account_setup_cubit_test.dart

@@ -465,4 +465,62 @@ void main() {
       }),
     );
   });
+
+  group("where new accounts wait for the instance's operator (Halkyon "
+      "Learn's ADR 0021, D19, D31)", () {
+    /// A sign-up up to the code mailed, with the handle `anna`.
+    Future<AccountSetupCubit> upToTheCode() async {
+      final cubit = setUpAs(AccountSetupMode.signUp)
+        ..addressEntered('anna@example.org');
+      await cubit.passwordEntered('correct horse', 'correct horse');
+      cubit.phraseWrittenDown();
+      await cubit.phraseChecked(wordsAsked(cubit.state));
+      cubit.handleEntered('anna');
+      return cubit;
+    }
+
+    test('the new account waits: the device keeps its wait in place of a '
+        'session, sets up no authenticator, and the sheet shows no '
+        'problem, as the wait screen takes its place', () async {
+      auth.offeredSignUps = SignUps.approval;
+      final cubit = await upToTheCode();
+
+      final states = await statesOf(
+        cubit,
+        () => cubit.mailCodeEntered(gateway.codeFor('anna@example.org')),
+      );
+
+      final person = gateway.accounts['anna@example.org']!.person;
+      expect(auth.status, Waiting(fakeWaitOf(person, handle: 'anna')));
+      expect(states, [at(AccountSetupStep.mailCode, busy: true)]);
+      expect(gateway.calls, isNot(contains('enrol')));
+      expect(auth.usedSessions, isEmpty);
+    });
+
+    test('closed, the code proves the address first, then the sign-up is '
+        'refused, and nothing is made', () async {
+      auth.offeredSignUps = SignUps.closed;
+      final cubit = await upToTheCode();
+
+      await cubit.mailCodeEntered(gateway.codeFor('anna@example.org'));
+
+      expect(
+        cubit.state,
+        at(AccountSetupStep.mailCode, problem: PasswordProblem.signUpsClosed),
+      );
+      expect(gateway.accounts, isEmpty);
+      expect(auth.status, const SignedOut());
+    });
+
+    test('closed, an account of before (an address, no password) still takes '
+        'its password', () async {
+      auth.offeredSignUps = SignUps.closed;
+      gateway.addAddressOnly('anna@example.org');
+      final cubit = await upToTheCode();
+
+      await cubit.mailCodeEntered(gateway.codeFor('anna@example.org'));
+
+      expect(cubit.state, at(AccountSetupStep.authenticator));
+    });
+  });
 }