feat(base): signing in with SimpleLogin through the register (ADR 0020, step 2)

The `simpleLogin` endpoint on halkyon_oidc's SimpleLogin preset: `begin`
for the app and platform (the state's marker for the forwarding page), at
most 30 an hour per network; `complete` with SimpleLogin's code, signed out
a session for the account with that SimpleLogin ID, signed in SimpleLogin
added to the caller's account, who becomes identified and anonymous no
longer. Someone new gets no account yet: their identity waits 30 minutes
under the attempt's ID (D16), with a handle suggested from their name,
`anna_mueller` (D17), for the sign-up of step 3.

The register alone holds the instance's SimpleLogin app
(`simpleLoginClientId`, `simpleLoginClientSecret`) and exchanges codes; a
member asks it for both steps and issues its own session. `SIGN_IN_WAYS`
says which ways the register offers, the instance's basics and the ways
in carry `simpleLogin`, GitHub links nobody more where SimpleLogin is
offered, and Learn's and Todo's pruning forgets the unfinished sign-ins
hourly. No migration: the tables are halkyon_oidc's, already in place.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

deploy/.env.example

@@ -90,6 +90,21 @@ EMAIL_FROM=
 TOTP_KEY=
 RECOVERY_CODE_KEY=
 SIGN_IN_DECOY_KEY=
+# SimpleLogin (ADR 0020): people sign in with their SimpleLogin or Proton account, of
+# which the instance keeps only SimpleLogin's ID for them (no address, no name). Off
+# unless both are set: the client ID and secret of this instance's own SimpleLogin app
+# (SimpleLogin → Settings → Developer → New website), registered with the callback
+# /simplelogin-callback on the server's web address (on learn.halkyon.eu's server
+# https://learn.halkyon.eu/simplelogin-callback), its forwarding page back to the apps.
+SIMPLELOGIN_CLIENT_ID=
+SIMPLELOGIN_CLIENT_SECRET=
+# Another callback than this server's own page, as the app registered it (https only).
+#SIMPLELOGIN_CALLBACK_URL=https://learn.example.org/simplelogin-callback
+# The ways in the app offers, of those set up above: simplelogin, password, or both
+# (separated by spaces or commas). Empty: every way set up. An unknown name stops the
+# server as it starts.
+#SIGN_IN_WAYS=simplelogin
+
 # The day GitHub stops signing anyone in, three months after the release that brings
 # passwords (ADR 0017, D2): from then on its people sign in with their address and
 # password only, and the daily pruning forgets every GitHub ID. Empty: GitHub goes on.

deploy/compose.yaml

@@ -83,6 +83,14 @@ services:
       SERVERPOD_PASSWORD_totpKey: ${TOTP_KEY:-}
       SERVERPOD_PASSWORD_recoveryCodeKey: ${RECOVERY_CODE_KEY:-}
       SERVERPOD_PASSWORD_signInDecoyKey: ${SIGN_IN_DECOY_KEY:-}
+      # SimpleLogin (ADR 0020), only with the instance's SimpleLogin app; empty: off.
+      # Its callback; empty: this server's own page, on its web server's public address
+      # (https://learn.halkyon.eu/simplelogin-callback).
+      SERVERPOD_PASSWORD_simpleLoginClientId: ${SIMPLELOGIN_CLIENT_ID:-}
+      SERVERPOD_PASSWORD_simpleLoginClientSecret: ${SIMPLELOGIN_CLIENT_SECRET:-}
+      SIMPLELOGIN_CALLBACK_URL: ${SIMPLELOGIN_CALLBACK_URL:-}
+      # The ways in offered, of those set up (`simplelogin password`); empty: all.
+      SIGN_IN_WAYS: ${SIGN_IN_WAYS:-}
       # Caddy, whose X-Forwarded-For names the visitor the per-network limits count
       # (new anonymous accounts, codes by mail, password sign-ins): without it, every
       # visitor would share each limit with everyone. Its address on `edge`, below.