docs(auth): proofs bound to the base URL and to what they approve (ADR 0017)

The full reading's part in ADR 0017 records the device's medium 1 as done
(the identity's purpose and digest, the base URL in place of the host, an
instance under a path taking no password sign-in), and "The rules as they
stand" says what "password" binds; the module's and halkyon_app's READMEs
say the same.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_app/README.md

@@ -71,7 +71,10 @@ Written as the apps are: Dart 3.13's primary constructors, Material from
   `showAccountRecoverySheet`, and `AccountSecuritySection` for an app's
   account part. Every change of how the account is secured asks for the
   password with the code, one answer per sheet (`OwnerAnswer`, the owner's
-  proof: a session alone gets no code checked); deleting by a code by mail
+  proof: a session alone gets no code checked), each answer bound to the
+  instance's base URL and to the change it approves (its purpose and the
+  digest of what it sets, `proof_digests.dart`), so nobody between the device
+  and the instance swaps anything in; deleting by a code by mail
   follows `secondFactorWorks`, as the instance tells it, and asks for the
   address only where the device doesn't know it. Anonymous people get no keys until something is encrypted
   (step 4). Every build of an app needs a C compiler and make: sodium's build