feat(auth)!: codes by mail no longer sign in

ADR 0017, step 3 (D4: nobody signs in with email codes yet, so the
password replaces them outright). `emailCode.verifyCode`,
`emailSignIn.signIn` and the switch token go, with the register's
`verifySignInCode` and `completeEmailSwitch` and their operations
between services. `emailCode.sendCode` stays, now without a session
(signing up and getting back in have none), as what proves an address
for a password's setup, a sign-up, a setup never finished and the
resets; `accountRecovery.sendCode`, which did that for the resets,
goes. The `switchChallengeId` column stays: Serverpod's challenges
still link a completion token, and older servers read it during a
deploy.

The apps: halkyon_app's email sign-in (its bloc, sheet, gateway calls
and the start screen's Continue with email) goes; Learn's profile and
Todo's account sheet show `AccountSecuritySection` (a password set up
by someone anonymous or signing in with GitHub, whose end it names;
the authenticators; changing the password; new recovery codes and
phrase), which reads anew after every change the repository makes.

BREAKING CHANGE: Learn's `minimumAppBuild` is 22: builds up to 21 sign
in with the endpoints that went. Todo was never released and stays at
build 1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_server/test/integration/password/password_change_test.dart

@@ -72,7 +72,7 @@ void main() {
       Future<({UuidValue request, String code})> mailedCode(
         String address,
       ) async {
-        final request = await endpoints.accountRecovery.sendCode(
+        final request = await endpoints.emailCode.sendCode(
           notSignedIn(),
           address: address,
           language: 'en',

packages/halkyon_base_server/test/integration/password/password_test.dart

@@ -75,7 +75,7 @@ void main() {
       Future<({UuidValue request, String code})> mailedCode(
         String address,
       ) async {
-        final request = await endpoints.accountRecovery.sendCode(
+        final request = await endpoints.emailCode.sendCode(
           notSignedIn(),
           address: address,
           language: 'en',
@@ -674,37 +674,13 @@ void main() {
           );
         });
 
-        test('refuses email codes and GitHub for an account that signs in '
-            'with a password and an authenticator, not before', () async {
-          final ben = await newAnonymousPerson(session);
-          final bensLaptop = await signInNewDevice(session, ben);
-          final asBen = sessionBuilder.copyWith(
-            authentication: AuthenticationOverride.authenticationInfo(
-              ben.uuid,
-              {},
-              authId: bensLaptop.uuid,
-            ),
-          );
+        test('refuses GitHub for an account that signs in with a password '
+            'and an authenticator, not before', () async {
           await annaSetsPassword();
           await GitHubAccount.db.insertRow(
             session,
             GitHubAccount(userIdentifier: '1001', authUserId: anna),
           );
-          Future<EmailCodeAccepted> switchByCode() async {
-            final request = await endpoints.emailCode.sendCode(
-              asBen,
-              address: 'anna@example.org',
-              language: 'en',
-            );
-            return await endpoints.emailCode.verifyCode(
-              asBen,
-              request: request,
-              code: mailbox.codeFor('anna@example.org'),
-            );
-          }
-
-          final early = await switchByCode();
-          expect(early.switchToken, isNotNull);
           expect(await signsInWithPassword(session, anna), isFalse);
           expect(await gitHubAccountToSignIn(session, '1001'), anna);
 
@@ -722,17 +698,6 @@ void main() {
           });
 
           expect(await signsInWithPassword(session, anna), isTrue);
-          await expectLater(
-            endpoints.emailSignIn.signIn(
-              notSignedIn(),
-              switchToken: early.switchToken!,
-            ),
-            refusedAsEmail(EmailSignInRefusal.usePassword),
-          );
-          await expectLater(
-            switchByCode(),
-            refusedAsEmail(EmailSignInRefusal.usePassword),
-          );
           await expectLater(
             gitHubAccountToSignIn(session, '1001'),
             throwsA(
@@ -1262,26 +1227,6 @@ void main() {
           );
           // Nor does a code by mail or GitHub sign in in its place.
           expect(await signsInWithPassword(session, anna), isTrue);
-          final ben = await newAnonymousPerson(session);
-          final asBen = sessionBuilder.copyWith(
-            authentication: AuthenticationOverride.authenticationInfo(
-              ben.uuid,
-              {},
-            ),
-          );
-          final request = await endpoints.emailCode.sendCode(
-            asBen,
-            address: 'anna@example.org',
-            language: 'en',
-          );
-          await expectLater(
-            endpoints.emailCode.verifyCode(
-              asBen,
-              request: request,
-              code: mailbox.codeFor('anna@example.org'),
-            ),
-            refusedAsEmail(EmailSignInRefusal.usePassword),
-          );
           await expectLater(
             gitHubAccountToSignIn(session, '1001'),
             throwsA(

packages/halkyon_base_server/test/integration/password/ways_in_test.dart

@@ -61,7 +61,7 @@ void main() {
       Future<({UuidValue request, String code})> mailedCode(
         String address,
       ) async {
-        final request = await endpoints.accountRecovery.sendCode(
+        final request = await endpoints.emailCode.sendCode(
           notSignedIn(),
           address: address,
           language: 'en',