feat(auth): a password with TOTP on the register, and resets

The register's side of signing in with an address, a password that never
leaves the device (SRP-6a) and a code from an authenticator (ADR 0017),
with members forwarding every step through AccountRegister:

- password.set: salt, Argon2id's costs, SRP's verifier, the public keys
  and the private keys wrapped twice, all made on the device; with the
  address a mailed code proves, an anonymous person becomes identified
  under their ID. It signs in once an authenticator is confirmed.
- passwordSignIn.begin and complete: SRP's two steps with a TOTP or
  recovery code. An address nobody has is answered from a decoy key as
  an account would be; every wrong credential is refused alike.
- authenticator: secrets sealed under totpKey (XChaCha20-Poly1305, bound
  to their row), each code accepted once, ten recovery codes with the
  first, the last one kept.
- accountRecovery: a lost authenticator reset 72 hours after the
  password and a mailed code or the recovery phrase ask, a lost password
  set anew with the phrase's signature, or the account reset with new
  keys 72 hours after a mailed code asks; a mail at each start, a
  sign-in calling it off.
- An account with a password no longer signs in by a mailed code or
  GitHub; no new GitHub account is linked where passwords are offered,
  and from GITHUB_SIGN_IN_ENDS GitHub signs nobody in and its IDs go.

Five tables, added by the module's migration; deletePerson deletes
their rows.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_server/lib/base.dart

@@ -2,8 +2,8 @@
 /// (`HalkyonBase.configure`), how people authenticate, the account's
 /// deletion and the pruning, email sign-in's helpers, the instance's
 /// basics, people's public profiles and their pages, the instance's register
-/// (ADR 0016), SRP's register side, TOTP and recovery codes (ADR 0017), and
-/// the module's models.
+/// (ADR 0016), signing in with a password and TOTP and getting back into an
+/// account (ADR 0017), and the module's models.
 library;
 
 export 'src/auth/account.dart';
@@ -11,6 +11,7 @@ export 'src/auth/auth_config.dart';
 export 'src/auth/code_mail.dart';
 export 'src/auth/email.dart';
 export 'src/auth/github.dart';
+export 'src/auth/github_sign_in_endpoint.dart' show gitHubAccountToSignIn;
 export 'src/auth/identified.dart';
 export 'src/auth/scopes.dart';
 export 'src/common/short_code.dart';
@@ -18,6 +19,22 @@ export 'src/generated/protocol.dart' hide Protocol;
 export 'src/halkyon_base.dart';
 export 'src/instance/data_location.dart';
 export 'src/instance/source_code.dart';
+export 'src/password/authenticators.dart'
+    show
+        forgetUnconfirmedAuthenticators,
+        maxAuthenticators,
+        unconfirmedAuthenticatorLifetime;
+export 'src/password/key_proof.dart' show keyProofMessage;
+export 'src/password/password_config.dart';
+export 'src/password/passwords.dart'
+    show
+        newPasswordCosts,
+        passwordGroup,
+        passwordMethod,
+        resetDelay,
+        signInChallengeLifetime,
+        signsInWithPassword,
+        wrappedKeysLength;
 export 'src/profile/link_verification.dart';
 export 'src/profile/profile_page.dart' show addProfilePageRoute, profilePage;
 export 'src/profile/profile_rules.dart'