feat(accounts): one account across an instance's services (ADR 0016)

halkyon_base runs as the instance's register or as one of its members.
The register keeps the ways in, handles and profiles; members ask it
over HTTP with the instance's shared secret (instanceSecret), and open
sessions of their own for its accounts, under the same account ID.

- AccountsMode from the environment: INSTANCE_MEMBERS on the register,
  ACCOUNT_REGISTER_URL on a member. Learn always holds the register
  (Explore joins the profiles); Todo is a member where it is set.
- AccountRegister: LocalRegister, RemoteRegister, an in-memory one in
  tests. Calls between services on the web server, refused without the
  secret (constant-time compare); a server needing it doesn't start
  without it.
- Deleting an account deletes it everywhere: notices per member kept in
  the deletion's transaction (account_deletion_notice), told at once and
  hourly until confirmed; members prune daily whom the register no longer
  knows, never while it knows none of them or can't be reached.
- Deploy: INSTANCE_SECRET and INSTANCE_MEMBERS in compose and .env.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

apps/learn/halkyon_learn_server/lib/server.dart

@@ -17,7 +17,9 @@ Future<void> run(List<String> args) async {
   final pod = Serverpod(args);
   // What every Halkyon server has (ADR 0014): sign-in, the account and its
   // deletion, the pruning, the instance's basics, set up for Learn.
-  HalkyonBase.configure(pod, learnBase());
+  // Learn holds the instance's register of accounts (ADR 0016), telling the
+  // instance's other services when one goes.
+  HalkyonBase.configure(pod, learnBase(accounts: learnAccounts()));
   pod
     // Token managers validate and issue authentication keys; identity
     // providers are the ways people can sign in (halkyon_base's
@@ -30,6 +32,9 @@ Future<void> run(List<String> args) async {
     ..addCloudStorage(DatabaseCloudStorage('private'))
     ..addCloudStorage(DatabaseCloudStorage('public'));
 
+  // The calls of the instance's other services, on the web server
+  // (ADR 0016); Caddy never forwards them.
+  addInstanceRoutes(pod);
   // The assistant connector, on the web server (ADR 0006).
   addConnectorRoutes(pod);
   // Profile pages, `/@handle`, which profile links link back to (ADR 0011),
@@ -63,6 +68,15 @@ Future<void> run(List<String> args) async {
       .pruning
       .forgetSignUpAttempts();
 
+  // The deletions the instance's members haven't confirmed yet, hourly
+  // (ADR 0016).
+  await pod.futureCalls.cancel(_deletionNotices);
+  await pod.futureCalls
+      .callRecurring(identifier: _deletionNotices)
+      .cron('52 * * * *')
+      .pruning
+      .tellMembersOfDeletions();
+
   // The assistant connector's expired codes and tokens (ADR 0006, rule 5).
   await pod.futureCalls.cancel(_connectorPruning);
   await pod.futureCalls
@@ -121,6 +135,9 @@ const _pruning = 'prune-abandoned-anonymous-people';
 /// The identifier of the hourly forgetting of sign-up attempts.
 const _attemptPruning = 'forget-sign-up-attempts';
 
+/// The identifier of the hourly telling of the members of deleted accounts.
+const _deletionNotices = 'tell-members-of-deletions';
+
 /// The identifier of the daily forgetting of the connector's expired secrets.
 const _connectorPruning = 'forget-connector-secrets';