fix(auth)!: the recovery phrase is proved by a key of its own

A key proof was a signature by the account's signing key, which every
signed-in device keeps in its keyring: whoever could read one, with a
code from its authenticator, set a new password without the password or
the phrase (the second reading's H1). The phrase now proves itself with
an Ed25519 key derived from its bits alone (halkyon_keys'
recoveryProofKeysOf, KDF context hlkrprf1, a sibling of the recovery
key), whose public half every setup, new phrase and account reset sends
and the register keeps (account_password.recoveryProofKey); the device
derives the secret half only while the phrase is typed. An account
without one (none exist outside development) proves no phrase until it
sets a new one; decoys check against a decoy proof key alike.

Migration (module, Learn's and Todo's servers, Learn's device schema):
ALTER TABLE "account_password" ADD COLUMN "recoveryProofKey" bytea;
nullable, so rows made before keep working and no data is touched.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_server/README.md

@@ -209,8 +209,10 @@ Built on the three parts above, on the register (members forward every step thro
 - **Resets:** a lost authenticator: SRP's proof plus a mailed code or the recovery
   phrase's signature asks for it; it takes effect 72 hours later, a mail tells the
   address at once, and signing in with a code calls it off; then the password alone
-  signs in until a new authenticator is confirmed. A lost password with the phrase: the
-  account's Ed25519 signature over a nonce (`keyProofMessage`) and a code set a new
+  signs in until a new authenticator is confirmed. A lost password with the phrase: a
+  signature over a nonce (`keyProofMessage`) by the phrase's own proof key (Ed25519,
+  derived from the phrase alone, its public half kept as `recoveryProofKey`; never the
+  account's signing key, which every signed-in device keeps) and a code set a new
   password, the keys staying. A lost password without it: a mailed code asks, 72 hours
   pass (a mail at the start, a sign-in calls it off), a new code carries it out: new
   password, new keys, no authenticators.