build(make): prove setup converged instead of trusting build_runner's exit code

`make setup` ran build_runner and reported success whether it produced the
39 files a fresh clone needs or almost nothing. `flutter test`'s only guard
checked a single sentinel file, which is why the 2026-08-09 4-of-46 gap
still read as 26 passed / 17 failed instead of a missing build step.

ci/check_codegen.sh walks every `part` directive under lib/ and confirms
the sibling file it names exists, then wires into both `setup` (fail loud
right after codegen if it under-produced) and `test` (fail loud, exit 69,
if nobody ran setup at all). Replaces the one-file guard, which would have
missed 44 of the 45 directives that exist today.

Makefile

@@ -16,15 +16,20 @@ help: ## Show this help
 setup: ## Fetch dependencies and generate code (run this after a fresh clone)
 	flutter pub get
 	$(MAKE) generate
+	@ci/check_codegen.sh
 
 .PHONY: generate
 generate: ## Regenerate freezed/json_serializable/riverpod sources
 	dart run build_runner build --delete-conflicting-outputs
 
+.PHONY: check-codegen
+check-codegen: ## Prove every part directive has a generated file on disk
+	@ci/check_codegen.sh
+
 .PHONY: test
 test: ## Run the widget and unit tests
-	@test -f lib/core/auth/user_preferences.freezed.dart \
-	  || { echo "FAIL — generated sources missing; run: make setup"; exit 69; }
+	@ci/check_codegen.sh \
+	  || { echo "FAIL — generated sources missing or stale; run: make setup"; exit 69; }
 	flutter test
 
 # Why the guard above: *.freezed.dart and lib/**/*.g.dart are gitignored, so a
@@ -33,6 +38,23 @@ test: ## Run the widget and unit tests
 # looks like broken tests and is actually a missing build step. After
 # generating, the same suite is 452 passed. A test run that cannot compile
 # should say so in those words.
+#
+# `setup` and `test` both call ci/check_codegen.sh rather than one calling
+# the other's target, because `setup`'s job is "make the tree usable" (fails
+# loud if codegen silently produced less than the tree needs) and `test`'s
+# job is "is the tree usable right now" (fails loud if nobody ran setup at
+# all, or ran it before a source file changed). Same check, two different
+# questions, so a shared script rather than a shared Make target — a Make
+# target can only be reused by depending on it, which would make `test`
+# imply `flutter pub get` and `build_runner`, both slow, every run.
+#
+# The check walks every `part '<name>.g.dart'`/`part '<name>.freezed.dart'`
+# directive under lib/ and confirms the named sibling file exists — not one
+# sentinel file (the previous guard checked only
+# user_preferences.freezed.dart, which would have missed 44 of the 45
+# directives that exist today). See ci/check_codegen.sh for why this is
+# preferred over `flutter analyze`: cheaper, and it targets exactly the
+# generated/ungenerated distinction rather than static analysis in general.
 
 .PHONY: lint
 lint: ## Static analysis (analysis_options.yaml at the repo root)