fix(auth)!: the recovery phrase is proved by a key of its own

A key proof was a signature by the account's signing key, which every
signed-in device keeps in its keyring: whoever could read one, with a
code from its authenticator, set a new password without the password or
the phrase (the second reading's H1). The phrase now proves itself with
an Ed25519 key derived from its bits alone (halkyon_keys'
recoveryProofKeysOf, KDF context hlkrprf1, a sibling of the recovery
key), whose public half every setup, new phrase and account reset sends
and the register keeps (account_password.recoveryProofKey); the device
derives the secret half only while the phrase is typed. An account
without one (none exist outside development) proves no phrase until it
sets a new one; decoys check against a decoy proof key alike.

Migration (module, Learn's and Todo's servers, Learn's device schema):
ALTER TABLE "account_password" ADD COLUMN "recoveryProofKey" bytea;
nullable, so rows made before keep working and no data is touched.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_server/test/integration/test_tools/serverpod_test_tools.dart

@@ -1071,6 +1071,7 @@ class _PasswordEndpoint {
     String? totpCode,
     String? recoveryCode,
     required _iji0wmu8.WrappedKeys recoveryKeys,
+    required _idt.ByteData recoveryProofKey,
   }) async {
     return _ist.callAwaitableFunctionAndHandleExceptions(() async {
       var _localUniqueSession =
@@ -1090,6 +1091,7 @@ class _PasswordEndpoint {
             'totpCode': totpCode,
             'recoveryCode': recoveryCode,
             'recoveryKeys': recoveryKeys,
+            'recoveryProofKey': recoveryProofKey,
           }),
           serializationManager: _serializationManager,
         );