feat(base)!: no anonymous accounts on the server (ADR 0020, D25)

The server's half of D25: every account has a way in, and the anonymous
accounts left from before go with the daily pruning.

- The module signs nobody in anonymously: `anonymousIdp` and
  `gitHubUpgrade` are gone, and so is linking GitHub at the register.
- A password is set only by someone whose address is theirs (a
  `firstPassword` code) or who signs in with GitHub alone (a fresh
  sign-in and a `signUp` code); an anonymous account is refused
  `wrongCredentials` before any code is used.
- SimpleLogin refuses to link onto a caller without `identified`
  (`wrongCaller`), the member's endpoint too, so nothing turns an
  anonymous account into one with a way in.
- `pruneAnonymousPeople` deletes every anonymous account left, however
  new, never one identified. Learn and Todo schedule it as
  `prune-accounts` and cancel the old `prune-abandoned-anonymous-people`
  entry once.
- Learn: someone without `identified` keeps no files;
  `FILE_LIMIT_ANONYMOUS_MB` is gone. `minimumAppBuild` is 23, as builds
  up to 22 start with an anonymous account.
- Learn's sync tests make their person and session by SQL in the
  development database, as Serverpod stores sessions.
- Docs, store listings and ADRs 0010, 0014, 0016, 0017 and 0019 amended.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

apps/learn/halkyon_learn_server/test/integration/asset/asset_test.dart

@@ -58,15 +58,14 @@ void main() {
         spaces.clear();
       });
 
-      TestSessionBuilder signedIn(
-        UuidValue person, {
-        Set<Scope> scopes = const {},
-      }) => sessionBuilder.copyWith(
-        authentication: AuthenticationOverride.authenticationInfo(
-          person.uuid,
-          scopes,
-        ),
-      );
+      /// [person]'s session, `identified` unless [scopes] say otherwise.
+      TestSessionBuilder signedIn(UuidValue person, {Set<Scope>? scopes}) =>
+          sessionBuilder.copyWith(
+            authentication: AuthenticationOverride.authenticationInfo(
+              person.uuid,
+              scopes ?? {identified},
+            ),
+          );
 
       /// Adds [bytes] as [person], as the app does: asks how to upload them,
       /// uploads them unless the server has them, and finishes the upload.
@@ -74,7 +73,7 @@ void main() {
         UuidValue person,
         List<int> bytes, {
         String? as,
-        Set<Scope> scopes = const {},
+        Set<Scope>? scopes,
         bool? encrypted,
       }) async {
         final hash = as ?? sha256.convert(bytes).toString();
@@ -387,8 +386,7 @@ void main() {
       group('room', () {
         setUp(() {
           fileLimits = const FileLimits(
-            anonymousBytes: 10,
-            identifiedBytes: 20,
+            identifiedBytes: 10,
             instanceBytes: 1000,
           );
         });
@@ -400,7 +398,7 @@ void main() {
                   .having((e) => e.usedBytes, 'usedBytes', used),
             );
 
-        test('an anonymous person keeps no more than their room', () async {
+        test('a person keeps no more than their room', () async {
           expect(await add(alice, List.filled(8, 1)), isTrue);
 
           await expectLater(
@@ -413,15 +411,18 @@ void main() {
           );
         });
 
-        test('an identified person keeps more', () async {
-          expect(
-            await add(alice, List.filled(15, 1), scopes: {identified}),
-            isTrue,
-          );
+        test('an anonymous account left from before keeps nothing '
+            '(ADR 0020, D25)', () async {
           await expectLater(
-            add(bob, List.filled(15, 1)),
+            add(bob, [1], scopes: const {}),
             refused(instanceFull: false, used: 0),
           );
+          expect(
+            (await endpoints.asset.usage(
+              signedIn(bob, scopes: const {}),
+            )).limitBytes,
+            0,
+          );
         });
 
         test('an allowance gives one person more, and nobody else', () async {
@@ -441,8 +442,7 @@ void main() {
           // Whatever other tests left behind counts too: the room is set
           // from what the instance holds now.
           fileLimits = FileLimits(
-            anonymousBytes: 10,
-            identifiedBytes: 20,
+            identifiedBytes: 10,
             instanceBytes: await _instanceBytes(session) + 12,
           );
           expect(await add(alice, List.filled(8, 1)), isTrue);
@@ -550,8 +550,7 @@ void main() {
           expect((usage.usedBytes, usage.limitBytes), (4, 10));
 
           fileLimits = FileLimits(
-            anonymousBytes: 10,
-            identifiedBytes: 20,
+            identifiedBytes: 10,
             instanceBytes: await _instanceBytes(session) + 2,
           );
           final tight = await endpoints.asset.usage(signedIn(alice));