feat(auth): ways in for accounts without a working password

ADR 0017, step 3. Signing up takes an address a mailed code proves and
a password's setup, without a session (`passwordSignIn.signUp`): an
address nobody has becomes a new identified account, and an account
with the address but no password (codes by mail before; no keys exist,
so nothing waits) takes the password, keeping its ID. A setup never
finished signs in with its password and a code mailed to the address it
began with, until an authenticator is confirmed, which also calls off a
reset of the account waiting; any other account takes no code by mail
in place of its second factor and leaves the code unused. A reset of
the whole account waiting no longer counts as having had an
authenticator, so its owner isn't locked out until it completes.

Members forward both through the register; the tests' shared helpers
move into `support/password_support.dart`.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_server/test/integration/support/password_support.dart

@@ -0,0 +1,54 @@
+import 'package:halkyon_base_server/base.dart';
+import 'package:serverpod/serverpod.dart';
+import 'package:serverpod_auth_idp_server/core.dart';
+import 'package:test/test.dart';
+
+/// Throws a [PasswordRefusedException] for [reason].
+Matcher refused(PasswordRefusal reason) => throwsA(
+  isA<PasswordRefusedException>().having(
+    (error) => error.reason,
+    'reason',
+    reason,
+  ),
+);
+
+/// Throws an [EmailSignInRefusedException] for [reason].
+Matcher refusedAsEmail(EmailSignInRefusal reason) => throwsA(
+  isA<EmailSignInRefusedException>().having(
+    (error) => error.reason,
+    'reason',
+    reason,
+  ),
+);
+
+/// Deletes everything the tests make.
+Future<void> deleteAll(Session session) async {
+  await SignInChallenge.db.deleteWhere(
+    session,
+    where: (t) => t.id.notEquals(null),
+  );
+  await AccountReset.db.deleteWhere(session, where: (t) => t.id > 0);
+  await RecoveryCode.db.deleteWhere(session, where: (t) => t.id > 0);
+  await TotpAuthenticator.db.deleteWhere(
+    session,
+    where: (t) => t.id.notEquals(null),
+  );
+  await AccountPassword.db.deleteWhere(session, where: (t) => t.id > 0);
+  await RateLimitedRequestAttempt.db.deleteWhere(
+    session,
+    where: (t) => t.id.notEquals(null),
+  );
+  await EmailCodeRequest.db.deleteWhere(
+    session,
+    where: (t) => t.id.notEquals(null),
+  );
+  await SecretChallenge.db.deleteWhere(
+    session,
+    where: (t) => t.id.notEquals(null),
+  );
+  await EmailIdentity.db.deleteWhere(
+    session,
+    where: (t) => t.id.notEquals(null),
+  );
+  await AuthUser.db.deleteWhere(session, where: (t) => t.id.notEquals(null));
+}