refactor(base,learn): people's files kept by halkyon_base

ADR 0043, D2, D4, D6 and D7, the first step towards Todo's attachments:
Learn's file store moves into the module, for every server that keeps
files, and Learn becomes its first host.

halkyon_base gets the store as Learn had it: uploads into the caller's
own space by SHA-256, downloads by a row the caller may read, each
person's room (FILE_LIMIT_IDENTIFIED_MB, FILE_LIMIT_INSTANCE_MB, the
operator's file_allowance, which moves into the module unchanged) and
the pruning of files no live row names. It stays free of the sync
engine: a host hands it a FileStore saying which of its rows name a file
and what it takes (HalkyonBase.files); without one the files endpoint
refuses. Its tests, with refusals, run on a stand-in host.

Learn hands it learnFiles: its asset rows, read by their space's members,
a readable file over 20 MB only as a PDF, up to 100 MB. Its app calls the
module; its own asset endpoint stays for released apps alone, forwarding
to the module in Learn's own models, whose names are on the wire. Its
file tests still pass through it, end to end.

Migrations: the module's creates file_allowance. Learn's server migration
holds version rows alone, as tables are matched by name (ADR 0014); its
device migration creates the module's empty table, as every module's.
Todo's, Train's and Meditate's create the empty table.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_server/test/integration/support/fixtures.dart

@@ -21,7 +21,7 @@ const testMinimumAppBuild = 7;
 /// Sets the module up on the pod [sessionBuilder]'s sessions run on, as a
 /// host does before its pod starts, for [app], with [deletePersonData] as
 /// its deletions, [profilePageNote] at the foot of profile pages and
-/// [privacyPagePoints] on the privacy page, and
+/// [privacyPagePoints] on the privacy page, [files] as its file store, and
 /// authentication exactly as hosts run it
 /// (`auth_config.dart`). Not on `Serverpod.instance`: that is the pod made
 /// last, and a test file with several `withServerpod` groups has a pod each.
@@ -32,6 +32,7 @@ void useBase(
   ProfilePageNote? profilePageNote,
   List<PrivacyPagePoint> privacyPagePoints = const [],
   AccountsMode accounts = const HoldsRegister(),
+  FileStore? files,
 }) {
   final pod = sessionBuilder.build().serverpod;
   HalkyonBase.configure(
@@ -45,6 +46,7 @@ void useBase(
       profilePageNote: profilePageNote,
       privacyPagePoints: privacyPagePoints,
       accounts: accounts,
+      files: files,
     ),
   );
   // No password sign-in unless a test gives it keys, and no SimpleLogin