feat(base): the changes of SimpleLogin accounts' keys, each with the password and a fresh sign-in (ADR 0020, D20)

Every change takes the password's proof by its own proof key (the
recovery phrase's for a lost password) and a SimpleLogin sign-in of the
last ten minutes on the device (`KeysOwnerProof`, its attempt), as ADR
0017's take the password and a code. The sign-in is checked before the
proof and taken with the change, so a wrong proof leaves it standing and
each sign-in serves one change.

- `keys.set(attempt, setup, handle?)`: the first keys of an account that
  SimpleLogin was added to (anonymous before, or signing in with GitHub
  or a code), with the handle where it has none; the sign-in alone, as
  there is no password to prove yet.
- `keys.changePassword`, `keys.beginPhrase` and `keys.resetPassword` (a
  lost password, with the phrase): every other session ends, in every
  service, as ADR 0017's change has it.
- `keys.setRecoveryKeys`: a new phrase.
- `account.delete(keysProof)`: an account without SRP's verifier deletes
  itself with the proof and the sign-in; `requireOwnerToDelete` no longer
  asks such an account for SRP.
- `newKeysPasswordDigest` on both sides, held to each other by a test; a
  challenge purpose of its own for the phrase's proof while signed in.
- Members ask the register for all of it; `RemoteRegister` and the
  instance API carry the five new operations and the deletion's proof.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_server/lib/src/register/instance_api.dart

@@ -240,6 +240,48 @@ Future<Map<String, Object?>?> _answer(
         arguments.model('proof', KeysProof.fromJson),
       );
       return {'keys': keys.toJson()};
+    case RegisterOperation.setFirstKeys:
+      await register.setFirstKeys(
+        session,
+        person: arguments.id('person'),
+        attempt: arguments.id('attempt'),
+        setup: arguments.model('setup', KeysSetup.fromJson),
+        handle: arguments.optionalString('handle'),
+      );
+      return const {};
+    case RegisterOperation.beginPhraseKeyProof:
+      final challenge = await register.beginPhraseKeyProof(
+        session,
+        arguments.id('person'),
+      );
+      return {'challenge': challenge.toJson()};
+    case RegisterOperation.changeKeysPassword:
+      await register.changeKeysPassword(
+        session,
+        person: arguments.id('person'),
+        proof: arguments.model('proof', KeysOwnerProof.fromJson),
+        password: arguments.model('password', KeysPassword.fromJson),
+        keepSession: arguments.optionalId('keepSession'),
+      );
+      return const {};
+    case RegisterOperation.resetKeysPassword:
+      await register.resetKeysPassword(
+        session,
+        person: arguments.id('person'),
+        proof: arguments.model('proof', KeysOwnerProof.fromJson),
+        password: arguments.model('password', KeysPassword.fromJson),
+        keepSession: arguments.optionalId('keepSession'),
+      );
+      return const {};
+    case RegisterOperation.setKeysRecovery:
+      await register.setKeysRecovery(
+        session,
+        person: arguments.id('person'),
+        proof: arguments.model('proof', KeysOwnerProof.fromJson),
+        recoveryKeys: arguments.model('recoveryKeys', WrappedKeys.fromJson),
+        recoveryProofKey: arguments.bytes('recoveryProofKey'),
+      );
+      return const {};
     case RegisterOperation.signInWaysOf:
       final ways = await register.signInWaysOf(
         session,
@@ -264,6 +306,9 @@ Future<Map<String, Object?>?> _answer(
         proof: arguments.has('proof')
             ? arguments.model('proof', DeletionProof.fromJson)
             : null,
+        keysProof: arguments.has('keysProof')
+            ? arguments.model('keysProof', KeysOwnerProof.fromJson)
+            : null,
       );
       return const {};
     case RegisterOperation.knownAccounts: