feat(base): handles hidden until their people go public, every answer about a new handle counted (ADR 0020, D5)

A handle's page and profiles.byHandle answer as for a handle nobody has
until its person goes public: a handle fixed by a publish, or a display
name, a bio, a link or an avatar (isPublic). A person's own profile, and
the host's own lookups (personWithHandle), are unchanged.

So every answer about a new handle now tells that an account has it,
and countHandleCheck counts them together on the register, 30 an hour
per person (or attempt) and 60 per network, refused beyond with
ProfileRefusal.tooManyHandleChecks: profile.checkHandle and saving a
profile with a handle new for the person, simpleLogin.checkHandle and
signUp, keys.set with a handle, and Halkyon Learn's inbox.block and
unblock, which look people up by handle. A person's own handle and what
is no handle aren't counted. The SimpleLogin limiters of commit 3 give
way to it, so a network's 60 are shared between people signed in and
people new. The register's checkHandle, saveProfile,
signUpWithSimpleLogin and setFirstKeys carry the visitor's network from
the member that asked.

Halkyon Learn's handle dialog words the new refusal (English, German).

Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

docs/adr/0020-sign-in-with-simplelogin.md

@@ -52,6 +52,17 @@
   decoy; mending ends every session of the account, as whoever came in through the old
   link may still be in; and SimpleLogin needs `SIGN_IN_DECOY_KEY` alone of ADR 0017's
   three keys, a server with a SimpleLogin app and without it stopping as it starts.
+  Then handles (9, D5): `/@handle` and `profiles.byHandle` answer as for a handle nobody
+  has until its person goes public (a handle fixed by a publish, or a display name, a
+  bio, a link or an avatar), the host's own code still finding whose a handle is.
+  Otherwise than proposed: not only asking whether a handle is free is limited, but
+  every answer about a new handle, counted together (`countHandleCheck`, 30 an hour per
+  person or attempt, 60 per network): saving a profile with one, signing up and the
+  first keys with one, and Halkyon Learn's blocks by handle, as each tells the same, so
+  a limit on checking alone would limit nothing; a person's own handle and what is no
+  handle aren't counted. The handle suggested at sign-up is not counted: it tells at
+  most that the name SimpleLogin shared is someone's handle already, once a sign-in.
+  Step 3's deviations accepted by the developer (23 Oct, night).
 - **Builds on:** ADR 0010 (email sign-in), ADR 0011 (profile pages), ADR 0016 (the
   register), ADR 0017 (a password, TOTP and the keys).
 - **Changes:** ADR 0017's way in on an instance that offers SimpleLogin (its keys, their