feat(auth)!: codes by mail no longer sign in

ADR 0017, step 3 (D4: nobody signs in with email codes yet, so the
password replaces them outright). `emailCode.verifyCode`,
`emailSignIn.signIn` and the switch token go, with the register's
`verifySignInCode` and `completeEmailSwitch` and their operations
between services. `emailCode.sendCode` stays, now without a session
(signing up and getting back in have none), as what proves an address
for a password's setup, a sign-up, a setup never finished and the
resets; `accountRecovery.sendCode`, which did that for the resets,
goes. The `switchChallengeId` column stays: Serverpod's challenges
still link a completion token, and older servers read it during a
deploy.

The apps: halkyon_app's email sign-in (its bloc, sheet, gateway calls
and the start screen's Continue with email) goes; Learn's profile and
Todo's account sheet show `AccountSecuritySection` (a password set up
by someone anonymous or signing in with GitHub, whose end it names;
the authenticators; changing the password; new recovery codes and
phrase), which reads anew after every change the repository makes.

BREAKING CHANGE: Learn's `minimumAppBuild` is 22: builds up to 21 sign
in with the endpoints that went. Todo was never released and stays at
build 1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

apps/todo/halkyon_todo_flutter/lib/src/account/account_sheet.dart

@@ -5,9 +5,10 @@ import 'package:halkyon_ui/halkyon_ui.dart';
 import 'package:lucide_icons_flutter/lucide_icons.dart';
 import 'package:material_ui/material_ui.dart';
 
-/// The account: halkyon_app's section (whose it is, on which instance,
-/// switching to the account on another, signing out and deleting it) in
-/// Todo's words where only Todo can say it; and About.
+/// The account: halkyon_app's sections (whose it is, on which instance,
+/// switching to the account on another, signing out and deleting it; its
+/// password and authenticators) in Todo's words where only Todo can say it;
+/// and About.
 Future<void> showAccountSheet(BuildContext context) => showAdaptiveSheet(
   context,
   builder: (context) => const _AccountSheet(),
@@ -27,6 +28,12 @@ class const _AccountSheet() extends StatelessWidget {
             signOutAnonymousMessage: l10n.accountSignOutAnonymousMessage,
             deleteMessage: l10n.accountDeleteMessage,
           ),
+          // A password and an authenticator keep the account, and sign in
+          // on other devices and in the instance's other apps (ADR 0017).
+          const Padding(
+            padding: EdgeInsets.symmetric(horizontal: 16),
+            child: AccountSecuritySection(),
+          ),
           ListTile(
             leading: const Icon(LucideIcons.info),
             title: Text(l10n.aboutTitle),