fix(auth)!: a first password takes a fresh proof of the account's way in

The fourth reading's first finding: password.set took a session alone,
so whoever took one made a GitHub-only account, or an address account
without a password, theirs for good (their address or password, their
authenticator; GitHub then refused the owner).

- An account with an address proves it anew: a code mailed to that
  address for this (EmailCodePurpose.firstPassword, its own mail), never
  the session alone, a code asked for anything else, or another address.
- An account that signs in with GitHub alone does it within 10 minutes of
  a GitHub sign-in (the session's method and creation time, where the
  session lives; members tell the register), refused signInAgain before
  any code is used; the address it adds is proved as before.
- Anonymous people still become identified with a code to the address
  they add.

The app mails the code to the person's own address (asking for it where
the device doesn't know it), offers a password right after a GitHub
sign-in (D2's "at their next sign-in") before the person's app, and asks
for a GitHub sign-in anew when the instance refuses an older one, keeping
the code typed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_client/lib/src/protocol/auth/email_code_purpose.dart

@@ -32,7 +32,11 @@ enum EmailCodePurpose implements _isc.SerializableModel {
   accountReset,
 
   /// Deleting an account whose setup never finished, with the password.
-  deletion;
+  deletion,
+
+  /// Proving, signed in, the account's own address to give it its first
+  /// password (the fourth reading: a session alone sets none).
+  firstPassword;
 
   static EmailCodePurpose fromJson(String name) {
     switch (name) {
@@ -46,6 +50,8 @@ enum EmailCodePurpose implements _isc.SerializableModel {
         return EmailCodePurpose.accountReset;
       case 'deletion':
         return EmailCodePurpose.deletion;
+      case 'firstPassword':
+        return EmailCodePurpose.firstPassword;
       default:
         throw ArgumentError(
           'Value "$name" cannot be converted to "EmailCodePurpose"',

packages/halkyon_base_client/lib/src/protocol/client.dart

@@ -437,9 +437,12 @@ class EndpointPassword extends _isc.EndpointRef {
 
   /// Gives the caller the password [setup] describes (all of it made on the
   /// device), with the address [code] proves for [request] (mailed with
-  /// `emailCode.sendCode`) unless the caller has one; refusals as
-  /// `setPassword`'s. It signs in once an authenticator is confirmed
-  /// (`authenticator.confirm`).
+  /// `emailCode.sendCode`): the caller's own where they have one
+  /// (`EmailCodePurpose.firstPassword`), else the one they add
+  /// (`EmailCodePurpose.signUp`); someone who signs in with GitHub alone
+  /// does it within [gitHubSignInFreshFor] of signing in with GitHub on this
+  /// session. Refusals as `setPassword`'s. It signs in once an authenticator
+  /// is confirmed (`authenticator.confirm`).
   _ida.Future<void> set({
     required _ipn3lqh9.PasswordSetup setup,
     _isc.UuidValue? request,

packages/halkyon_base_client/lib/src/protocol/password/password_refusal.dart

@@ -88,7 +88,12 @@ enum PasswordRefusal implements _isc.SerializableModel {
   /// couldn't open a session for it yet (its clock is behind the
   /// register's): sign in again with the new password. Never "this
   /// instance has no password sign-in" (the re-review's tenth finding).
-  passwordChanged;
+  passwordChanged,
+
+  /// A first password for an account that signs in with GitHub alone takes
+  /// a GitHub sign-in of the last 10 minutes (the fourth reading: a session
+  /// alone sets none): sign in with GitHub again, then set it.
+  signInAgain;
 
   static PasswordRefusal fromJson(String name) {
     switch (name) {
@@ -132,6 +137,8 @@ enum PasswordRefusal implements _isc.SerializableModel {
         return PasswordRefusal.sessionEnded;
       case 'passwordChanged':
         return PasswordRefusal.passwordChanged;
+      case 'signInAgain':
+        return PasswordRefusal.signInAgain;
       default:
         throw ArgumentError(
           'Value "$name" cannot be converted to "PasswordRefusal"',