fix(auth)!: a first password takes a fresh proof of the account's way in

The fourth reading's first finding: password.set took a session alone,
so whoever took one made a GitHub-only account, or an address account
without a password, theirs for good (their address or password, their
authenticator; GitHub then refused the owner).

- An account with an address proves it anew: a code mailed to that
  address for this (EmailCodePurpose.firstPassword, its own mail), never
  the session alone, a code asked for anything else, or another address.
- An account that signs in with GitHub alone does it within 10 minutes of
  a GitHub sign-in (the session's method and creation time, where the
  session lives; members tell the register), refused signInAgain before
  any code is used; the address it adds is proved as before.
- Anonymous people still become identified with a code to the address
  they add.

The app mails the code to the person's own address (asking for it where
the device doesn't know it), offers a password right after a GitHub
sign-in (D2's "at their next sign-in") before the person's app, and asks
for a GitHub sign-in anew when the instance refuses an older one, keeping
the code typed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_app/test/auth/widget/session_gate_test.dart

@@ -119,10 +119,27 @@ void main() {
     gateway.gitHubError = null;
     await tester.tap(find.text('Sign in with GitHub'));
     await tester.pumpAndSettle();
+    // A password is offered first (ADR 0017, D2), while the sign-in is
+    // recent enough to set one; put off, the person's app.
+    expect(find.text('Set up a password'), findsWidgets);
+    await tester.tap(find.text('Later'));
+    await tester.pumpAndSettle();
     expect(find.text('App of github-person'), findsOneWidget);
     expect(gateway.signIns, 0);
   });
 
+  testWidgets('after GitHub, offers no password to someone who has one, or '
+      'where the instance offers none', (tester) async {
+    dependencies.passwordGateway.offered = false;
+    await dependencies.signedOut.write(signedOut: true);
+    await start(tester);
+
+    await tester.tap(find.text('Sign in with GitHub'));
+    await tester.pumpAndSettle();
+    expect(find.text('Later'), findsNothing);
+    expect(find.text('App of github-person'), findsOneWidget);
+  });
+
   testWidgets('offers only the ways the instance has', (tester) async {
     gateway.offersGitHub = false;
     dependencies.passwordGateway.offered = false;