test(app): the password cubits' states, every refusal included

Signing in (a code, a recovery code, an account never finished, a lost
authenticator by mail and by phrase, an impostor instance, no
connection), setting up (signing up, a password for someone signed in,
finishing an account's reset with new keys or the old), getting back in
(with the phrase, starting a reset without it) and the account section
(what keeps the account, its steps, adding an authenticator, a new
phrase), each as the states it emits.

They found that reading what keeps the account wrapped two refusals at
once in a ParallelWaitError, which no caller takes for one: offline, the
account section showed nothing. The first refusal now goes up as it is.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_app/lib/src/password/data/password_repository.dart

@@ -287,7 +287,12 @@ class PasswordRepository(
   /// What keeps the signed-in person's account.
   Future<AccountSecurity> security() async {
     final person = _signedIn();
-    final (offers, ways) = await (_gateway.offers(), _gateway.ways()).wait;
+    // Both asked at once, the first refusal going up as it is: a record's
+    // `wait` would wrap the two in a ParallelWaitError, which no caller
+    // takes for a refusal (the account section then showed nothing offline).
+    final waysRead = _gateway.ways()..ignore();
+    final offers = await _gateway.offers();
+    final ways = await waysRead;
     return AccountSecurity(
       offered: offers.offered,
       hasAddress: ways.email,