refactor(base): SimpleLogin's forwarding page on the OpenID Connect module (ADR 0023)

halkyon_base depends on halkyon_oidc_server, and its forwarding page
is now the module's (`addOidcCallbackForwarding`) with Halkyon's table
of apps and its page in English or German; its tests keep what is
Halkyon's own, the rest is tested in the module.

Every host now includes the module: migrations `…-oidc-module` in
halkyon_base, Learn and Todo create its two tables (no data touched)
and record its version; Learn's devices get them empty, as they have
halkyon_base's server-only tables. halkyon_base_client depends on
halkyon_oidc_client, whose models its generated code uses, and Learn's
server image copies both packages into its narrowed workspace.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_server/README.md

@@ -44,14 +44,15 @@ Endpoints, under the nickname `base` in a host's client (`client.modules.base.em
   served by `addProfilePageRoute`, in English or German, its foot what the host's
   `profilePageNote` says.
 - SimpleLogin's forwarding page (Halkyon Learn's ADR 0020; `addSimpleLoginCallbackRoute`,
-  on the register): `/simplelogin-callback`, the one address the instance's SimpleLogin
+  on the register, on halkyon_oidc's `addOidcCallbackForwarding`, ADR 0023):
+  `/simplelogin-callback`, the one address the instance's SimpleLogin
   app registers, as SimpleLogin takes only https addresses, each registered exactly. It
   answers a 303 to the app that began the sign-in, with SimpleLogin's `code` (or its
   `error`) and the `state`, and nothing else: the state is `<app>-<platform>.<rest>`, the
   marker one of `simpleLoginReturns` (the desktop's loopback, `127.0.0.1` on a port of each
   app's own, or the phone's scheme, the app's ID), the rest 1 to 512 characters of
   base64url; anything else gets a page saying the sign-in can't go on, repeating nothing
-  it was given. It keeps and logs nothing.
+  it was given, in English or German. It keeps and logs nothing.
 - **Per-network limits** (new anonymous accounts, codes by mail, password sign-ins,
   proofs of the recovery phrase) count by the visitor's IP address (`networkOf`): the
   connection's, or, for a connection from a proxy the operator trusts