fix(auth)!: a first password takes a fresh proof of the account's way in

The fourth reading's first finding: password.set took a session alone,
so whoever took one made a GitHub-only account, or an address account
without a password, theirs for good (their address or password, their
authenticator; GitHub then refused the owner).

- An account with an address proves it anew: a code mailed to that
  address for this (EmailCodePurpose.firstPassword, its own mail), never
  the session alone, a code asked for anything else, or another address.
- An account that signs in with GitHub alone does it within 10 minutes of
  a GitHub sign-in (the session's method and creation time, where the
  session lives; members tell the register), refused signInAgain before
  any code is used; the address it adds is proved as before.
- Anonymous people still become identified with a code to the address
  they add.

The app mails the code to the person's own address (asking for it where
the device doesn't know it), offers a password right after a GitHub
sign-in (D2's "at their next sign-in") before the person's app, and asks
for a GitHub sign-in anew when the instance refuses an older one, keeping
the code typed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_server/test/unit/code_mail_test.dart

@@ -127,6 +127,8 @@ void main() {
             "to switch off your authenticator app's codes",
         EmailCodePurpose.accountReset: 'to reset your account',
         EmailCodePurpose.deletion: 'to delete your account',
+        EmailCodePurpose.firstPassword:
+            'to give your account on learn.halkyon.eu its first password',
       };
       const german = {
         EmailCodePurpose.signUp: 'um dein Konto auf learn.halkyon.eu anzulegen',
@@ -135,6 +137,9 @@ void main() {
             'um die Codes deiner Authenticator-App',
         EmailCodePurpose.accountReset: 'zurückzusetzen',
         EmailCodePurpose.deletion: 'mit allem darin zu löschen',
+        EmailCodePurpose.firstPassword:
+            'um deinem Konto auf learn.halkyon.eu sein erstes Passwort zu '
+            'geben',
       };
       for (final purpose in EmailCodePurpose.values) {
         final en = mailFor(purpose, 'en').body;
@@ -179,6 +184,9 @@ void main() {
             'K7QX-M2PD: your Halkyon Learn code to reset your account',
         EmailCodePurpose.deletion:
             'K7QX-M2PD: your Halkyon Learn code to delete your account',
+        EmailCodePurpose.firstPassword:
+            'K7QX-M2PD: your Halkyon Learn code to give your account a '
+            'password',
       };
       const german = {
         EmailCodePurpose.signUp:
@@ -193,6 +201,9 @@ void main() {
             'K7QX-M2PD: dein Halkyon-Learn-Code, um dein Konto zurückzusetzen',
         EmailCodePurpose.deletion:
             'K7QX-M2PD: dein Halkyon-Learn-Code, um dein Konto zu löschen',
+        EmailCodePurpose.firstPassword:
+            'K7QX-M2PD: dein Halkyon-Learn-Code, um deinem Konto ein Passwort '
+            'zu geben',
       };
       for (final purpose in EmailCodePurpose.values) {
         expect(subjectOf(purpose, 'en'), english[purpose]);