feat(base,app,keys): keys of shared spaces, sealed to each member

Step 3 of ADR 0044 (D3, D18, D19). A shared space's data keys are
sealed on a device to each member's public keys; the instance keeps
what devices sealed and never opens it.

- halkyon_keys: the safety code of two accounts' public keys
  (`safetyCode`), 60 digits, the same on both sides.
- halkyon_base: the register hands out accounts' public keys
  (`public-keys-of`, local and remote); the table `shared_space_key`
  and the endpoint `sharedSpaceKeys` (memberKeys, keysNeeded, seal,
  mine). Only the Owner and Editors seal, the first key sealed to a
  member stays, and a member's keys go with their membership. Every
  host's migration creates the table.
- halkyon_app: `ContentCipher` seals a key to another account and
  opens one sealed by another; `SharedKeys` shares a space's key with
  its members, seals keys to newcomers and opens the person's own,
  holding each member to the public keys `KeyPins` pinned on first
  sight (`key_pins.json` in the person's folder), a change refused
  until trusted anew.

Learn takes them into its `Privacy` in step 4.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_app/test/shared_space/key_pins_test.dart

@@ -0,0 +1,64 @@
+import 'dart:io';
+import 'dart:typed_data';
+
+import 'package:flutter_test/flutter_test.dart';
+import 'package:halkyon_app/halkyon_app.dart';
+
+/// The public keys a device pins for each person (Halkyon's ADR 0044, D18).
+void main() {
+  late Directory folder;
+  late File file;
+
+  PublicKeys keys(int mark) => (
+    encryption: Uint8List.fromList(List.filled(32, mark)),
+    signing: Uint8List.fromList(List.filled(32, mark + 1)),
+  );
+
+  setUp(() async {
+    folder = await Directory.systemTemp.createTemp('key_pins');
+    file = File('${folder.path}/person/key_pins.json');
+  });
+
+  tearDown(() => folder.delete(recursive: true));
+
+  test('the first keys seen stay pinned, on the next start too; others '
+      'are a change until trusted anew', () async {
+    final pins = KeyPins(FileKeyPinStore(file));
+    expect(await pins.check('bob', keys(1)), PinCheck.firstSeen);
+    expect(await pins.check('bob', keys(1)), PinCheck.same);
+    expect(await pins.check('bob', keys(3)), PinCheck.changed);
+
+    final later = KeyPins(FileKeyPinStore(file));
+    expect(await later.check('bob', keys(3)), PinCheck.changed);
+    expect(await later.check('bob', keys(1)), PinCheck.same);
+
+    await later.trustAnew('bob', keys(3));
+    expect(
+      await KeyPins(FileKeyPinStore(file)).check('bob', keys(3)),
+      PinCheck.same,
+    );
+  });
+
+  test('compared keys are marked so, until they are trusted anew', () async {
+    final pins = KeyPins(FileKeyPinStore(file));
+    await pins.check('bob', keys(1));
+    expect((await pins.of('bob'))!.verified, isFalse);
+
+    await pins.markVerified('bob');
+    expect((await KeyPins(FileKeyPinStore(file)).of('bob'))!.verified, isTrue);
+
+    await pins.trustAnew('bob', keys(3));
+    expect((await pins.of('bob'))!.verified, isFalse);
+  });
+
+  test('a file not holding pins counts as none', () async {
+    await file.parent.create(recursive: true);
+    await file.writeAsString('{not json');
+    expect(await FileKeyPinStore(file).read(), isEmpty);
+    await file.writeAsString(
+      '{"bob": {"encryption": "%%", "signing": "", '
+      '"verified": false}, "carol": 3}',
+    );
+    expect(await FileKeyPinStore(file).read(), isEmpty);
+  });
+}