feat(base): signing in with SimpleLogin through the register (ADR 0020, step 2)

The `simpleLogin` endpoint on halkyon_oidc's SimpleLogin preset: `begin`
for the app and platform (the state's marker for the forwarding page), at
most 30 an hour per network; `complete` with SimpleLogin's code, signed out
a session for the account with that SimpleLogin ID, signed in SimpleLogin
added to the caller's account, who becomes identified and anonymous no
longer. Someone new gets no account yet: their identity waits 30 minutes
under the attempt's ID (D16), with a handle suggested from their name,
`anna_mueller` (D17), for the sign-up of step 3.

The register alone holds the instance's SimpleLogin app
(`simpleLoginClientId`, `simpleLoginClientSecret`) and exchanges codes; a
member asks it for both steps and issues its own session. `SIGN_IN_WAYS`
says which ways the register offers, the instance's basics and the ways
in carry `simpleLogin`, GitHub links nobody more where SimpleLogin is
offered, and Learn's and Todo's pruning forgets the unfinished sign-ins
hourly. No migration: the tables are halkyon_oidc's, already in place.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

docs/adr/0020-sign-in-with-simplelogin.md

@@ -1,6 +1,6 @@
 # ADR 0020: Signing in with SimpleLogin only
 
-- **Status:** decided 23 Oct 2026, by the developer (D1–D15 below), the *Proposal*
+- **Status:** decided 23 Oct 2026, by the developer (D1–D17 below), the *Proposal*
   with it (D15).
 - **Built (23 Oct 2026), step 1:** the forwarding page (3),
   `/simplelogin-callback` on the register's web server (halkyon_base's
@@ -16,6 +16,21 @@
   held to `tool/release/android-certificate.sha256` by a test. The app's intent filter
   comes with the sign-in; iOS's associated domains wait for an Apple team ID, so iPhones
   come back through the forwarding page and the scheme until then.
+- **Built (23 Oct 2026), step 2:** the sign-in on the server's side (1 to 5), on
+  halkyon_oidc (ADR 0023) with its SimpleLogin preset: `simpleLogin.begin` and
+  `simpleLogin.complete` in halkyon_base, a member asking the register for both; the
+  instance's basics with `simpleLogin`, the ways in with it; the attempts and the
+  newcomers' identities forgotten hourly with the sign-up attempts. Otherwise than
+  proposed: the identities are halkyon_oidc's (`halkyon_oidc_identity`: account,
+  provider, subject; the provider `simplelogin`), not a table of halkyon_base's; the app
+  and platform are the state's marker rather than a column; a signed-in caller of a
+  member becomes a person on the register as the attempt begins, as linking would make
+  them; GitHub links nobody more where SimpleLogin is offered, as where passwords are
+  (ADR 0017); `SIGN_IN_WAYS` counts on the register, which members ask, and stops any
+  server with a name it doesn't know as it starts; sessions name the method
+  `simplelogin`. Someone new gets no account yet: their identity waits (D16), with a
+  handle suggested (D17), for the sign-up of step 3. halkyon_oidc's `testing.dart` gives
+  hosts a fake SimpleLogin signing real ID tokens, which the module's tests use too.
 - **Builds on:** ADR 0010 (email sign-in), ADR 0011 (profile pages), ADR 0016 (the
   register), ADR 0017 (a password, TOTP and the keys).
 - **Changes:** ADR 0017's way in on an instance that offers SimpleLogin (its keys, their
@@ -103,6 +118,18 @@ against app.simplelogin.io on 23 Oct:
   cut-off (step 5) follows 30 days after it.
 - **D15 The proposal (1–12) as written** (23 Oct, evening); what building it shows
   otherwise comes back to the developer.
+- **D16 A newcomer's identity waits 30 minutes** (23 Oct, night, recommended, over the
+  attempt's ten minutes or a day): long enough to choose a handle and make the keys, or
+  to find the recovery phrase and mend the link (8); after that they sign in with
+  SimpleLogin again, whose consent page they then skip. Nothing is reserved meanwhile,
+  the suggested handle neither.
+- **D17 Handles suggested as `anna_mueller`** (23 Oct, night, recommended): the name in
+  lower case, its words joined by underscores; German's letters as German writes them
+  without (ü as ue, ß as ss), æ, œ and þ as ae, oe and th, every other Latin letter
+  without its mark (é as e, ø as o); apostrophes dropped, anything else between words;
+  cut to 30 characters, and where the handle is taken (whatever its case) or kept by the
+  instance, a number from 2 to 99 after it. None where nothing of the name is left (a
+  name in another script): the person types one.
 - **Also (23 Oct):** the developer's own account moves by adding SimpleLogin to it while
   signed in with GitHub; the instance's SimpleLogin app goes up for approval once
   halkyon.app/learn exists, before learn.halkyon.eu switches.