feat(base): SimpleLogin accounts' keys without SRP, signing up in one call (ADR 0020, step 3)

An account that signs in with SimpleLogin keeps its keys under a password
that signs nobody in (D19): `account_password` keeps the password's own
proof key (Ed25519, `passwordProofKey`) in place of SRP's verifier, which
becomes nullable. The migration adds the column and drops the NOT NULL,
nothing else.

- `simpleLogin.signUp(attempt, handle, setup)`: someone new whose identity
  waits under the attempt gets, in one transaction, an account
  (identified), the link, a profile with the handle and the keys; then a
  session (D18). Refused, the identity still waiting, for a setup out of
  range and a handle refused as saving a profile refuses it.
- `simpleLogin.checkHandle(attempt, handle)`: whether someone new could
  take a handle, at most 30 an hour per attempt and 60 per network.
- `simpleLogin.complete` says, for an account, whether it has its keys and
  its handle, and keeps the sign-in ten minutes under its attempt, the
  account as its caller: D20's confirmation for the changes to come.
- `keys.begin`, `keys.unlock`: the keys for a signed-in device once the
  password is proven with its proof key, for a nonce, bound to the base
  URL the device addressed; wrong proofs counted per session as ADR
  0017's.
- An authenticator is enrolled only for a password that signs in.
- Members ask the register for all of it; `RemoteRegister` and the
  instance API carry the four new operations.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_server/lib/src/register/instance_api.dart

@@ -211,6 +211,35 @@ Future<Map<String, Object?>?> _answer(
         caller: arguments.optionalId('caller'),
       );
       return {'proof': proof.toJson()};
+    case RegisterOperation.checkSimpleLoginHandle:
+      final refusal = await register.checkSimpleLoginHandle(
+        session,
+        attempt: arguments.id('attempt'),
+        handle: arguments.string('handle'),
+        network: arguments.string('network'),
+      );
+      return {'refusal': refusal?.name};
+    case RegisterOperation.signUpWithSimpleLogin:
+      final account = await register.signUpWithSimpleLogin(
+        session,
+        attempt: arguments.id('attempt'),
+        handle: arguments.string('handle'),
+        setup: arguments.model('setup', KeysSetup.fromJson),
+      );
+      return {'account': account.uuid};
+    case RegisterOperation.beginPasswordKeyProof:
+      final challenge = await register.beginPasswordKeyProof(
+        session,
+        arguments.id('person'),
+      );
+      return {'challenge': challenge.toJson()};
+    case RegisterOperation.unlockKeys:
+      final keys = await register.unlockKeys(
+        session,
+        arguments.id('person'),
+        arguments.model('proof', KeysProof.fromJson),
+      );
+      return {'keys': keys.toJson()};
     case RegisterOperation.signInWaysOf:
       final ways = await register.signInWaysOf(
         session,