feat(accounts): one account across an instance's services (ADR 0016)

halkyon_base runs as the instance's register or as one of its members.
The register keeps the ways in, handles and profiles; members ask it
over HTTP with the instance's shared secret (instanceSecret), and open
sessions of their own for its accounts, under the same account ID.

- AccountsMode from the environment: INSTANCE_MEMBERS on the register,
  ACCOUNT_REGISTER_URL on a member. Learn always holds the register
  (Explore joins the profiles); Todo is a member where it is set.
- AccountRegister: LocalRegister, RemoteRegister, an in-memory one in
  tests. Calls between services on the web server, refused without the
  secret (constant-time compare); a server needing it doesn't start
  without it.
- Deleting an account deletes it everywhere: notices per member kept in
  the deletion's transaction (account_deletion_notice), told at once and
  hourly until confirmed; members prune daily whom the register no longer
  knows, never while it knows none of them or can't be reached.
- Deploy: INSTANCE_SECRET and INSTANCE_MEMBERS in compose and .env.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_server/test/integration/auth/github_test.dart

@@ -112,9 +112,10 @@ void main() {
           'created', () async {
         final people = await AuthUser.db.count(session);
 
-        await expectLater(
-          signInWithGitHubAccount(session, gitHubUserId: '3003'),
-          throwsA(_refusal(GitHubSignInRefusal.unknownAccount)),
+        // The endpoint refuses it (unknownAccount): nobody has it.
+        expect(
+          await accountWithGitHub(session, gitHubUserId: '3003'),
+          isNull,
         );
 
         expect(await AuthUser.db.count(session), people);
@@ -152,9 +153,11 @@ void main() {
 
     test('signing in with a known GitHub account starts a session for that '
         'person', () async {
-      final authSuccess = await signInWithGitHubAccount(
+      final account = await accountWithGitHub(session, gitHubUserId: '1001');
+      final authSuccess = await issueSession(
         session,
-        gitHubUserId: '1001',
+        account!,
+        method: gitHubMethod,
       );
 
       expect(authSuccess.authUserId, ben);