feat(base): SimpleLogin's forwarding page and Learn's App Links statement (ADR 0020, step 1)

SimpleLogin takes only https redirect addresses, each registered exactly,
so the instance's SimpleLogin app registers one page on the register's
web server, /simplelogin-callback, which sends the browser on to the app
that began the sign-in: a 303 to the desktop's loopback (127.0.0.1, a port
per app) or the phone's scheme, chosen by the marker the state begins with
(`<app>-<platform>.<rest>`, the rest 1 to 512 characters of base64url),
from a fixed table, so it sends nobody anywhere else. It forwards the code
or SimpleLogin's error (`deny`) with the state and nothing else, refuses
anything malformed, repeated or not a GET with a page that repeats nothing
it was given, and keeps and logs nothing (no-store, no referrer). It is
built ahead of the sign-in itself so development can sign in through
learn.halkyon.eu's page, which the development app registers too.

Android's assetlinks.json for Halkyon Learn signed with the release key
is answered by the Caddyfile on learn.halkyon.eu alone: the one domain the
project's builds name, and the server knows no app's key. A root test
holds its fingerprint to tool/release/android-certificate.sha256. The
app's intent filter comes with the sign-in; iOS's association waits for
an Apple team ID.

The profile page's language choice and look move to common/web_page.dart,
shared by both pages.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

apps/learn/halkyon_learn_server/config/production.yaml

@@ -15,9 +15,10 @@ apiServer:
 # port through an SSH tunnel, never through Caddy.
 
 # The web server serves profile pages (ADR 0011), the dictionaries devices
-# download (ADR 0012) and the calls between the instance's services (ADR 0016).
-# Caddy forwards the paths of the first two alone to it (deploy/Caddyfile),
-# never the third; everything else stays on the API server.
+# download (ADR 0012), SimpleLogin's forwarding page (ADR 0020) and the calls
+# between the instance's services (ADR 0016). Caddy forwards the paths of the
+# first three alone to it (deploy/Caddyfile), never the last; everything else
+# stays on the API server.
 webServer:
   port: 8082
   publicHost: learn.halkyon.eu

apps/learn/halkyon_learn_server/lib/server.dart

@@ -34,6 +34,9 @@ Future<void> run(List<String> args) async {
   // The calls of the instance's other services, on the web server
   // (ADR 0016); Caddy never forwards them.
   addInstanceRoutes(pod);
+  // Where SimpleLogin sends a sign-in back, which forwards it to the app
+  // (ADR 0020): the register's page, as its SimpleLogin app is.
+  addSimpleLoginCallbackRoute(pod);
   // Profile pages, `/@handle`, which profile links link back to (ADR 0011),
   // halkyon_base's since profiles are the instance's register's (ADR 0016).
   addProfilePageRoute(pod);