feat(base,app,learn): a shared space's key rolls once a member goes

What is written in a shared space after a member went takes a key they
never get (Halkyon's ADR 0044, D22). The instance marks the space as one
of its members goes, removed, leaving or deleted (`keyRollDue` on
`shared_space`, set in `removeMember`, through which each of them
passes); an invitation taken back never had a key and marks nothing, nor
does a new role. The Owner's or an Editor's device that next keeps its
keys up after a sync is told so (`sharedSpaceKeys.rollDue`, never true
for a Viewer, who seals no key) and makes a new key, sealed to those who
stay (D33). The first seal bringing a key ID the space never had clears
the mark in the same transaction (D34); members the rolling device
missed get it later as newcomers do. Earlier rows keep the key they had,
which whoever went had read already.

The migration, the same in the module and in each server including it
(Learn, Meditate, Todo, Train):

  ALTER TABLE "shared_space"
    ADD COLUMN "keyRollDue" boolean NOT NULL DEFAULT false;

It adds the column with false for every space there is, so no space is
due a roll from it; PostgreSQL adds a column with a constant default
without rewriting the table. The server before the switch reads and
writes the table naming its own columns, so it keeps working.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_client/lib/src/protocol/client.dart

@@ -1486,6 +1486,7 @@ class EndpointSharedSpaceKeys extends _isc.EndpointRef {
   /// first of two the call names alike. Refused for a
   /// Viewer: only those who write, the Owner and Editors, seal keys, so a
   /// reader can't hand a newcomer a key of their own making.
+  /// A key the space never had ends its being due a new one ([rollDue]).
   _ida.Future<void> seal(
     _isc.UuidValue space,
     List<_ie2by8eg.SharedSpaceSealedKey> keys,
@@ -1498,6 +1499,16 @@ class EndpointSharedSpaceKeys extends _isc.EndpointRef {
     },
   );
 
+  /// Whether [space] is due a new key, as a member went since its latest
+  /// was made (ADR 0044, D22, D33): for your device to make one and seal
+  /// it to the members. Never for a Viewer, who seals none ([seal]).
+  _ida.Future<bool> rollDue(_isc.UuidValue space) =>
+      caller.callServerEndpoint<bool>(
+        'halkyon_base.sharedSpaceKeys',
+        'rollDue',
+        {'space': space},
+      );
+
   /// The keys of [space] sealed to you, each naming who sealed it.
   _ida.Future<List<_ie2by8eg.SharedSpaceSealedKey>> mine(
     _isc.UuidValue space,