ci: throwaway test passwords, analytics off every time

The first CI run failed at the server tests: they need the test run mode's passwords,
which passwords.yaml holds on a developer's machine and which is never committed. Without
them Serverpod's test tools exit with code 1 and print nothing. Reproduced in a clean
clone; with the three passwords in the environment (SERVERPOD_DATABASE_PASSWORD,
SERVERPOD_PASSWORD_serverSideSessionKeyHashPepper, SERVERPOD_PASSWORD_serviceSecret) all
checks pass. The job now draws new random ones every time: they only guard the test
database it creates in its own checkout.

Also switch off Flutter's and Dart's usage reports on every job, not only when installing
the SDK: the cancelled first run left an SDK behind before getting that far.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

.forgejo/workflows/ci.yaml

@@ -60,15 +60,29 @@ jobs:
           if [ ! -x "$sdk/bin/flutter" ]; then
             rm -rf "$sdk"
             git clone -q --depth 1 --branch "$FLUTTER_VERSION" https://github.com/flutter/flutter.git "$sdk"
-            "$sdk/bin/flutter" config --no-analytics >/dev/null
-            "$sdk/bin/dart" --disable-analytics >/dev/null
           fi
+          # No usage reports to Google, every time: a cancelled job may have left an SDK
+          # behind before switching them off.
+          "$sdk/bin/flutter" config --no-analytics >/dev/null
+          "$sdk/bin/dart" --disable-analytics >/dev/null
           echo "$sdk/bin" >> "$FORGEJO_PATH"
           "$sdk/bin/flutter" --version
 
       - name: Dependencies
         run: flutter pub get
 
+      # The test run mode's passwords, which passwords.yaml holds on a developer's machine
+      # and which is never committed. Without them the server tests stop without a word.
+      # Throwaway and new for every job: they only guard the test database the job creates
+      # in its own checkout.
+      - name: Test passwords
+        run: |
+          for name in SERVERPOD_DATABASE_PASSWORD \
+            SERVERPOD_PASSWORD_serverSideSessionKeyHashPepper \
+            SERVERPOD_PASSWORD_serviceSecret; do
+            echo "$name=$(openssl rand -hex 32)" >> "$FORGEJO_ENV"
+          done
+
       - name: Checks
         run: tool/check.sh