fix(auth)!: proofs are bound to the instance's whole base URL

SRP's identity and the recovery phrase's proof carried the host alone, so
instances on one host under another port, path or scheme could relay each
other's proofs (the full reading's device low 4). Both now carry the base
URL the device addresses, written alike on both sides
(canonicalInstanceUrl: scheme and host in lower case, the port only where
it isn't the scheme's own, the path ending in /); the register takes its
own public scheme, host and port (Serverpod serves at the root), a member
the URL it names, development anything.

The identity also gains a purpose and the digest of what a proof sets,
both empty so far (signing in), with the framing for a new phrase's and an
authenticator's digest beside the new password's: the owner's proofs bind
them next. Cross-tests hold both sides to the same bytes. OwnerProof's and
DeletionProof's host, and every endpoint's, become instanceUrl.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_server/lib/src/register/instance_api.dart

@@ -260,7 +260,7 @@ Future<Map<String, Object?>?> _answer(
         recoveryCode: arguments.optionalString('recoveryCode'),
         request: arguments.optionalId('request'),
         code: arguments.optionalString('code'),
-        host: arguments.string('host'),
+        instanceUrl: arguments.string('instanceUrl'),
         address: arguments.string('address'),
         language: arguments.string('language'),
       );
@@ -331,7 +331,7 @@ Future<Map<String, Object?>?> _answer(
         code: arguments.optionalString('code'),
         keyChallenge: arguments.optionalId('keyChallenge'),
         signature: arguments.optionalBytes('signature'),
-        host: arguments.string('host'),
+        instanceUrl: arguments.string('instanceUrl'),
       );
       return {'pending': pending.toJson()};
     case RegisterOperation.beginKeyProof:
@@ -349,7 +349,7 @@ Future<Map<String, Object?>?> _answer(
         password: arguments.model('password', NewPassword.fromJson),
         totpCode: arguments.optionalString('totpCode'),
         recoveryCode: arguments.optionalString('recoveryCode'),
-        host: arguments.string('host'),
+        instanceUrl: arguments.string('instanceUrl'),
         address: arguments.string('address'),
         language: arguments.string('language'),
       );