feat(base): SimpleLogin accounts' keys without SRP, signing up in one call (ADR 0020, step 3)

An account that signs in with SimpleLogin keeps its keys under a password
that signs nobody in (D19): `account_password` keeps the password's own
proof key (Ed25519, `passwordProofKey`) in place of SRP's verifier, which
becomes nullable. The migration adds the column and drops the NOT NULL,
nothing else.

- `simpleLogin.signUp(attempt, handle, setup)`: someone new whose identity
  waits under the attempt gets, in one transaction, an account
  (identified), the link, a profile with the handle and the keys; then a
  session (D18). Refused, the identity still waiting, for a setup out of
  range and a handle refused as saving a profile refuses it.
- `simpleLogin.checkHandle(attempt, handle)`: whether someone new could
  take a handle, at most 30 an hour per attempt and 60 per network.
- `simpleLogin.complete` says, for an account, whether it has its keys and
  its handle, and keeps the sign-in ten minutes under its attempt, the
  account as its caller: D20's confirmation for the changes to come.
- `keys.begin`, `keys.unlock`: the keys for a signed-in device once the
  password is proven with its proof key, for a nonce, bound to the base
  URL the device addressed; wrong proofs counted per session as ADR
  0017's.
- An authenticator is enrolled only for a password that signs in.
- Members ask the register for all of it; `RemoteRegister` and the
  instance API carry the four new operations.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_server/test/integration/password/password_change_test.dart

@@ -277,7 +277,7 @@ void main() {
             (await AccountPassword.db.findFirstRow(
               session,
               where: (t) => t.authUserId.equals(anna),
-            ))!.verifier,
+            ))!.verifier!,
           );
           final mine = device.privateValue;
 
@@ -337,7 +337,7 @@ void main() {
               (await AccountPassword.db.findFirstRow(
                 session,
                 where: (t) => t.authUserId.equals(anna),
-              ))!.verifier,
+              ))!.verifier!,
             ),
             kept,
           );
@@ -794,7 +794,7 @@ void main() {
             Uint8List.sublistView(freshProofKey),
           );
           expect(
-            Uint8List.sublistView(after.verifier),
+            Uint8List.sublistView(after.verifier!),
             Uint8List.sublistView(newPassword.verifier),
           );
         });

packages/halkyon_base_server/test/integration/password/password_test.dart

@@ -240,7 +240,7 @@ void main() {
             where: (t) => t.authUserId.equals(anna),
           ))!;
           expect(
-            Uint8List.sublistView(kept.verifier),
+            Uint8List.sublistView(kept.verifier!),
             Uint8List.sublistView(device.verifier),
           );
           final ways = await endpoints.account.signInWays(asAnna());
@@ -574,7 +574,7 @@ void main() {
               (await AccountPassword.db.findFirstRow(
                 session,
                 where: (t) => t.authUserId.equals(anna),
-              ))!.verifier,
+              ))!.verifier!,
             ),
             Uint8List.sublistView(other.verifier),
           );
@@ -2432,7 +2432,7 @@ void main() {
               (await AccountPassword.db.findFirstRow(
                 session,
                 where: (t) => t.authUserId.equals(anna),
-              ))!.verifier,
+              ))!.verifier!,
             ),
             Uint8List.sublistView(device.verifier),
           );
@@ -3228,7 +3228,7 @@ void main() {
               (await AccountPassword.db.findFirstRow(
                 session,
                 where: (t) => t.authUserId.equals(anna),
-              ))!.verifier,
+              ))!.verifier!,
             ),
             Uint8List.sublistView(fresh.verifier),
           );