fix(auth)!: a first password takes a fresh proof of the account's way in

The fourth reading's first finding: password.set took a session alone,
so whoever took one made a GitHub-only account, or an address account
without a password, theirs for good (their address or password, their
authenticator; GitHub then refused the owner).

- An account with an address proves it anew: a code mailed to that
  address for this (EmailCodePurpose.firstPassword, its own mail), never
  the session alone, a code asked for anything else, or another address.
- An account that signs in with GitHub alone does it within 10 minutes of
  a GitHub sign-in (the session's method and creation time, where the
  session lives; members tell the register), refused signInAgain before
  any code is used; the address it adds is proved as before.
- Anonymous people still become identified with a code to the address
  they add.

The app mails the code to the person's own address (asking for it where
the device doesn't know it), offers a password right after a GitHub
sign-in (D2's "at their next sign-in") before the person's app, and asks
for a GitHub sign-in anew when the instance refuses an older one, keeping
the code typed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_app/lib/l10n/halkyon_app_de.arb

@@ -215,5 +215,10 @@
   "passwordAddressUnknown": "Gib die E-Mail-Adresse deines Kontos ein: Dorthin geht der Code.",
   "passwordDeleteIntroByMail": "Dein Konto wird mit allem darin gelöscht, in jedem Dienst dieser Instanz. Keiner seiner Authenticators funktioniert gerade, daher bestätigt es ein Code per E-Mail: Gib dein Passwort ein, dann den Code, den wir an deine Adresse schicken.",
   "passwordDeleteSendCode": "Code per E-Mail schicken",
-  "passwordChangedSignInAgain": "Dein Passwort wurde geändert, aber dieser Dienst konnte dich gerade noch nicht anmelden. Melde dich wieder mit dem neuen Passwort an."
+  "passwordChangedSignInAgain": "Dein Passwort wurde geändert, aber dieser Dienst konnte dich gerade noch nicht anmelden. Melde dich wieder mit dem neuen Passwort an.",
+  "passwordSignInAgain": "Um einem Konto, das sich mit GitHub anmeldet, ein Passwort zu geben, melde dich erst wieder mit GitHub an: Es ist mehr als ein paar Minuten her.",
+  "passwordSignInWithGitHubAgain": "Wieder mit GitHub anmelden",
+  "passwordOfferTitle": "Richte ein Passwort ein",
+  "passwordOfferBody": "Die Anmeldung mit GitHub endet. Richte ein Passwort und eine Authenticator-App ein, um dein Konto zu behalten.",
+  "passwordOfferLater": "Später"
 }

packages/halkyon_app/lib/l10n/halkyon_app_en.arb

@@ -462,5 +462,10 @@
   "passwordAddressUnknown": "Enter your account's email address: the code goes there.",
   "passwordDeleteIntroByMail": "Your account goes with everything in it, in every service of this instance. None of its authenticators works now, so a code by mail confirms it: type your password, then the code we email to your address.",
   "passwordDeleteSendCode": "Email me a code",
-  "passwordChangedSignInAgain": "Your password was changed, but this service couldn't sign you in just yet. Sign in again with the new password."
+  "passwordChangedSignInAgain": "Your password was changed, but this service couldn't sign you in just yet. Sign in again with the new password.",
+  "passwordSignInAgain": "To give an account that signs in with GitHub its password, sign in with GitHub again first: it has been more than a few minutes.",
+  "passwordSignInWithGitHubAgain": "Sign in with GitHub again",
+  "passwordOfferTitle": "Set up a password",
+  "passwordOfferBody": "Sign-in with GitHub is ending. Set up a password and an authenticator app to keep your account.",
+  "passwordOfferLater": "Later"
 }

packages/halkyon_app/lib/l10n/halkyon_app_localizations.dart

@@ -1398,6 +1398,36 @@ abstract class HalkyonAppLocalizations {
   /// In en, this message translates to:
   /// **'Your password was changed, but this service couldn\'t sign you in just yet. Sign in again with the new password.'**
   String get passwordChangedSignInAgain;
+
+  /// No description provided for @passwordSignInAgain.
+  ///
+  /// In en, this message translates to:
+  /// **'To give an account that signs in with GitHub its password, sign in with GitHub again first: it has been more than a few minutes.'**
+  String get passwordSignInAgain;
+
+  /// No description provided for @passwordSignInWithGitHubAgain.
+  ///
+  /// In en, this message translates to:
+  /// **'Sign in with GitHub again'**
+  String get passwordSignInWithGitHubAgain;
+
+  /// No description provided for @passwordOfferTitle.
+  ///
+  /// In en, this message translates to:
+  /// **'Set up a password'**
+  String get passwordOfferTitle;
+
+  /// No description provided for @passwordOfferBody.
+  ///
+  /// In en, this message translates to:
+  /// **'Sign-in with GitHub is ending. Set up a password and an authenticator app to keep your account.'**
+  String get passwordOfferBody;
+
+  /// No description provided for @passwordOfferLater.
+  ///
+  /// In en, this message translates to:
+  /// **'Later'**
+  String get passwordOfferLater;
 }
 
 class _HalkyonAppLocalizationsDelegate

packages/halkyon_app/lib/l10n/halkyon_app_localizations_de.dart

@@ -811,4 +811,21 @@ class HalkyonAppLocalizationsDe extends HalkyonAppLocalizations {
   @override
   String get passwordChangedSignInAgain =>
       'Dein Passwort wurde geändert, aber dieser Dienst konnte dich gerade noch nicht anmelden. Melde dich wieder mit dem neuen Passwort an.';
+
+  @override
+  String get passwordSignInAgain =>
+      'Um einem Konto, das sich mit GitHub anmeldet, ein Passwort zu geben, melde dich erst wieder mit GitHub an: Es ist mehr als ein paar Minuten her.';
+
+  @override
+  String get passwordSignInWithGitHubAgain => 'Wieder mit GitHub anmelden';
+
+  @override
+  String get passwordOfferTitle => 'Richte ein Passwort ein';
+
+  @override
+  String get passwordOfferBody =>
+      'Die Anmeldung mit GitHub endet. Richte ein Passwort und eine Authenticator-App ein, um dein Konto zu behalten.';
+
+  @override
+  String get passwordOfferLater => 'Später';
 }

packages/halkyon_app/lib/l10n/halkyon_app_localizations_en.dart

@@ -794,6 +794,23 @@ class HalkyonAppLocalizationsEn extends HalkyonAppLocalizations {
   @override
   String get passwordChangedSignInAgain =>
       'Your password was changed, but this service couldn\'t sign you in just yet. Sign in again with the new password.';
+
+  @override
+  String get passwordSignInAgain =>
+      'To give an account that signs in with GitHub its password, sign in with GitHub again first: it has been more than a few minutes.';
+
+  @override
+  String get passwordSignInWithGitHubAgain => 'Sign in with GitHub again';
+
+  @override
+  String get passwordOfferTitle => 'Set up a password';
+
+  @override
+  String get passwordOfferBody =>
+      'Sign-in with GitHub is ending. Set up a password and an authenticator app to keep your account.';
+
+  @override
+  String get passwordOfferLater => 'Later';
 }
 
 /// The translations for English, as used in the United Kingdom (`en_GB`).