feat(base): SimpleLogin's sign-in comes back by the app's scheme or the loopback (ADR 0020, D9 corrected)

simpleLogin.begin takes the way back (SimpleLoginReturn: loopback,
scheme) rather than the platform, so macOS can come back through its
scheme as iOS and Android do; the markers become learn-loopback,
learn-scheme, todo-loopback and todo-scheme. Not breaking: the
endpoint has never been released.

D9 corrected by the developer after research: Android, iOS and macOS
come back through the app's scheme, Linux and Windows through the
loopback. Verified links protected nothing here: a code caught on its
way is worthless without the attempt's ID, and a hostile app beginning
an attempt of its own can ask for a way back that other platforms need
open. The ADR notes the residual risk and the check of prompt=consent
still to do. assetlinks.json stays served.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_oidc_server/lib/src/callback_forwarding.dart

@@ -15,7 +15,7 @@ import 'package:serverpod/serverpod.dart';
 
 /// A state as the page takes it: a marker (letters, digits, `-` and `_`, up
 /// to 64), a dot, and the rest the sign-in began with, 1 to 512 characters
-/// of base64url (`learn-desktop.q3J…`). Nothing else, so nothing in it can
+/// of base64url (`learn-loopback.q3J…`). Nothing else, so nothing in it can
 /// reach the address it goes to but as the value of `state`.
 final _state = RegExp(r'^([A-Za-z0-9_-]{1,64})\.([A-Za-z0-9_-]{1,512})$');