fix(auth)!: the recovery phrase is proved by a key of its own

A key proof was a signature by the account's signing key, which every
signed-in device keeps in its keyring: whoever could read one, with a
code from its authenticator, set a new password without the password or
the phrase (the second reading's H1). The phrase now proves itself with
an Ed25519 key derived from its bits alone (halkyon_keys'
recoveryProofKeysOf, KDF context hlkrprf1, a sibling of the recovery
key), whose public half every setup, new phrase and account reset sends
and the register keeps (account_password.recoveryProofKey); the device
derives the secret half only while the phrase is typed. An account
without one (none exist outside development) proves no phrase until it
sets a new one; decoys check against a decoy proof key alike.

Migration (module, Learn's and Todo's servers, Learn's device schema):
ALTER TABLE "account_password" ADD COLUMN "recoveryProofKey" bytea;
nullable, so rows made before keep working and no data is touched.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

docs/adr/0017-password-totp-and-keys.md

@@ -134,8 +134,9 @@ through `AccountRegister`, the session being theirs.
   sent, none started); a sign-in with a code calls off every reset waiting. Once due,
   the first sign-in with the password alone carries it out (authenticators and recovery
   codes go), and the password alone signs in until a new authenticator is confirmed.
-  The recovery phrase is proved by the account's Ed25519 signature over
-  `halkyon key proof v1|`, the challenge's ID and a nonce. A password set with the
+  The recovery phrase is proved by a signature over `halkyon key proof v1|`, the
+  challenge's ID and a nonce, by the phrase's own proof key (since the second reading:
+  see below). A password set with the
   phrase, or an account reset, ends the account's sessions on the register's server.
 - **The account reset without the phrase waits 72 hours too, with a mail at the start**
   (a mailed code asks, a new one carries it out once due; a sign-in with the password