feat(auth)!: codes by mail no longer sign in

ADR 0017, step 3 (D4: nobody signs in with email codes yet, so the
password replaces them outright). `emailCode.verifyCode`,
`emailSignIn.signIn` and the switch token go, with the register's
`verifySignInCode` and `completeEmailSwitch` and their operations
between services. `emailCode.sendCode` stays, now without a session
(signing up and getting back in have none), as what proves an address
for a password's setup, a sign-up, a setup never finished and the
resets; `accountRecovery.sendCode`, which did that for the resets,
goes. The `switchChallengeId` column stays: Serverpod's challenges
still link a completion token, and older servers read it during a
deploy.

The apps: halkyon_app's email sign-in (its bloc, sheet, gateway calls
and the start screen's Continue with email) goes; Learn's profile and
Todo's account sheet show `AccountSecuritySection` (a password set up
by someone anonymous or signing in with GitHub, whose end it names;
the authenticators; changing the password; new recovery codes and
phrase), which reads anew after every change the repository makes.

BREAKING CHANGE: Learn's `minimumAppBuild` is 22: builds up to 21 sign
in with the endpoints that went. Todo was never released and stays at
build 1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_app/test/base/base_client_test.dart

@@ -12,6 +12,7 @@ String sent(SerializableException refusal) => jsonEncode({
       'halkyon_base.${switch (refusal) {
         EmailSignInRefusedException() => 'EmailSignInRefusedException',
         GitHubSignInRefusedException() => 'GitHubSignInRefusedException',
+        PasswordRefusedException() => 'PasswordRefusedException',
         _ => throw ArgumentError.value(refusal),
       }}',
   'data': (refusal as SerializableModel).toJson(),
@@ -70,10 +71,10 @@ void main() {
             ),
             200,
           ),
-          '/halkyon_base.emailSignIn/signIn' => http.Response(
+          '/halkyon_base.passwordSignIn/begin' => http.Response(
             sent(
-              EmailSignInRefusedException(
-                reason: EmailSignInRefusal.codeExpired,
+              PasswordRefusedException(
+                reason: PasswordRefusal.tooManyAttempts,
               ),
             ),
             400,
@@ -89,18 +90,18 @@ void main() {
     expect(basics.minimumAppBuild, 21);
     expect(basics.dataLocation, 'EU');
     await expectLater(
-      client.modules.emailSignIn.signIn(switchToken: 'token'),
+      client.modules.passwordSignIn.begin(address: 'anna@example.org'),
       throwsA(
-        isA<EmailSignInRefusedException>().having(
+        isA<PasswordRefusedException>().having(
           (refusal) => refusal.reason,
           'reason',
-          EmailSignInRefusal.codeExpired,
+          PasswordRefusal.tooManyAttempts,
         ),
       ),
     );
     expect(asked, [
       'https://learn.example.org/halkyon_base.instance/basics',
-      'https://learn.example.org/halkyon_base.emailSignIn/signIn',
+      'https://learn.example.org/halkyon_base.passwordSignIn/begin',
     ]);
   });
 }