feat(base)!: a handle at password sign-up (ADR 0020, D26, D28–D30)

Every new account gets a handle, and an account without one gets its
first as it sets a password. The handle is private until its person
goes public (D5).

- `passwordSignIn.signUp` takes a handle. `passwordSignIn.checkHandle`
  says whether a sign-up could take one, only while that sign-up's
  mailed code waits (`codeExpired` otherwise), counted per code request
  (30 an hour) and per network (60) (D29). Members ask the register.
- `password.set` takes the first handle of an account without one
  (D28); `SignInWays.handle` tells the app whether there is one.
- Each checks the handle before the code is used, so a refusal leaves
  the code for another try. An existing account at the address keeps
  its own handle where it has one, and the typed handle is still
  checked, so the answer says nothing about the address.
- `first_handle.dart` holds what SimpleLogin, the keys and passwords
  share: `refusalOfNewHandle`, `insertFirstProfile`, `hasHandle`.
- halkyon_app: one `HandleField` with its `HandleCheckCubit` (asked
  300 ms after typing pauses, only about the handle typed last; the
  instance's suggestion is free without asking) (D30). The password
  setup asks for the handle between the phrase check and the code, and
  a refusal at the code sends back to it. SimpleLogin's sign-up and
  keys steps use the same field and now check as it is typed.
- The module's README and ADR 0020 (D29, D30, the built state) amended.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_app/lib/l10n/halkyon_app_localizations.dart

@@ -619,6 +619,12 @@ abstract class HalkyonAppLocalizations {
   /// **'We emailed a code to {address}. It\'s valid for 15 minutes.'**
   String passwordMailCodeSent(String address);
 
+  /// No description provided for @passwordHandleIntro.
+  ///
+  /// In en, this message translates to:
+  /// **'A code is on its way to {address}. Meanwhile, choose your handle: others find you by it. It stays private until you publish something or fill in your profile, and can change until your first publish.'**
+  String passwordHandleIntro(String address);
+
   /// No description provided for @passwordResendCode.
   ///
   /// In en, this message translates to:
@@ -1585,23 +1591,29 @@ abstract class HalkyonAppLocalizations {
   /// **'Link it again with your handle and your recovery phrase.'**
   String get simpleLoginHaveOneHint;
 
-  /// No description provided for @simpleLoginHandleIntro.
+  /// No description provided for @handleIntro.
   ///
   /// In en, this message translates to:
   /// **'Others find you by your handle. It stays private until you publish something or fill in your profile, and can change until your first publish.'**
-  String get simpleLoginHandleIntro;
+  String get handleIntro;
 
-  /// No description provided for @simpleLoginHandle.
+  /// No description provided for @handleLabel.
   ///
   /// In en, this message translates to:
   /// **'Handle'**
-  String get simpleLoginHandle;
+  String get handleLabel;
 
-  /// No description provided for @simpleLoginHandleFree.
+  /// No description provided for @handleFree.
   ///
   /// In en, this message translates to:
   /// **'@{handle} is free'**
-  String simpleLoginHandleFree(String handle);
+  String handleFree(String handle);
+
+  /// No description provided for @handleChecking.
+  ///
+  /// In en, this message translates to:
+  /// **'Checking…'**
+  String get handleChecking;
 
   /// No description provided for @simpleLoginPasswordIntro.
   ///
@@ -1723,29 +1735,29 @@ abstract class HalkyonAppLocalizations {
   /// **'Too many sign-ins began from this network. Try again in an hour.'**
   String get simpleLoginTooManyAttempts;
 
-  /// No description provided for @simpleLoginHandleInvalid.
+  /// No description provided for @handleInvalid.
   ///
   /// In en, this message translates to:
   /// **'A handle is 1 to 30 letters (a to z), digits or underscores.'**
-  String get simpleLoginHandleInvalid;
+  String get handleInvalid;
 
-  /// No description provided for @simpleLoginHandleReserved.
+  /// No description provided for @handleReserved.
   ///
   /// In en, this message translates to:
   /// **'This handle is kept for the instance.'**
-  String get simpleLoginHandleReserved;
+  String get handleReserved;
 
-  /// No description provided for @simpleLoginHandleTaken.
+  /// No description provided for @handleTaken.
   ///
   /// In en, this message translates to:
   /// **'Someone else has this handle.'**
-  String get simpleLoginHandleTaken;
+  String get handleTaken;
 
-  /// No description provided for @simpleLoginTooManyHandleChecks.
+  /// No description provided for @handleTooManyChecks.
   ///
   /// In en, this message translates to:
   /// **'Too many handles were tried. Try again in an hour.'**
-  String get simpleLoginTooManyHandleChecks;
+  String get handleTooManyChecks;
 
   /// No description provided for @simpleLoginSectionTitle.
   ///