feat(crypto): SRP-6a, the register's half and the device's

ADR 0017's step 1. Generic over group and hash (SrpGroup); production
takes RFC 5054's 3072-bit group with SHA-256. k = H(N | PAD(g)),
u = H(PAD(A) | PAD(B)), K = H(PAD(S)),
M1 = H(H(N) xor H(g) | H(I) | s | PAD(A) | PAD(B) | K),
M2 = H(PAD(A) | M1 | K). A and B must lie in 1..N-1 and u must not be
0; a and b are 256 bits from Random.secure(); proofs are compared in
constant time. x comes from the caller (halkyon_keys makes it); RFC
5054's own x is there for the vectors only.

- The register's half in halkyon_base_server (base.dart: srpChallenge,
  srpVerify), the device's written by hand in halkyon_base_client
  (srp.dart: SrpClient, srpVerifier). Serverpod's generator cleans and
  writes only a client's lib/src/protocol/ (serverpod_cli 4.0.4's
  _getDirectoriesRequiringCleaning; a generate leaves srp/ untouched).
- Tests: RFC 5054 Appendix B on both halves; the client against the
  register, succeeding and every refusal.
- The module's tests depend on its client, and pub resolves every
  member's dev dependencies, so Learn's server image takes the module's
  client into its workspace too.
- The format check covers the hand-written half.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

test/check_files_test.dart

@@ -12,6 +12,12 @@ void main() {
       'apps/todo/halkyon_todo_flutter/lib/main.dart',
       'packages/halkyon_app/lib/halkyon_app.dart',
       'packages/halkyon_base_server/lib/src/auth/email.dart',
+      // SRP's client half, written by hand beside the module's generated
+      // client, and its tests.
+      'packages/halkyon_base_client/lib/srp.dart',
+      'packages/halkyon_base_client/lib/src/srp/srp_client.dart',
+      'packages/halkyon_base_client/test/srp_client_test.dart',
+      'packages/halkyon_keys/lib/src/account_keys.dart',
       'tool/check.dart',
     ]) {
       expect(isOwnDartFile(path), isTrue, reason: path);
@@ -20,10 +26,12 @@ void main() {
 
   test('what a generator writes is left as it wrote it', () {
     for (final path in [
-      // The client packages, Serverpod's from top to bottom.
+      // The client packages, Serverpod's from top to bottom, but for the
+      // module's SRP.
       'apps/learn/halkyon_learn_client/lib/src/protocol/client.dart',
       'apps/todo/halkyon_todo_client/lib/halkyon_todo_client.dart',
       'packages/halkyon_base_client/lib/src/protocol/protocol.dart',
+      'packages/halkyon_base_client/lib/halkyon_base_client.dart',
       // A server's generated sources and test tools.
       'apps/learn/halkyon_learn_server/lib/src/generated/protocol.dart',
       'packages/halkyon_base_server/lib/src/generated/endpoints.dart',