fix(auth): an account with a password deletes itself only with it and a code

A session alone deleted any account, with everything encrypted under its
keys (the second reading's lows; decided by the developer: the password
and a code, as a change of password takes). account.delete now takes a
DeletionProof (the password's SRP proof for a beginChange challenge, a
TOTP or recovery code, the host the device addressed); the register
checks it (requireOwnerToDelete), a member passing it on bound to its own
host. Accounts without a password, anonymous ones among them, delete with
their session as before. In the app, deleting an account with a password
asks for it and a code in a sheet of its own; a wrong one deletes
nothing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_server/lib/src/register/instance_api.dart

@@ -198,7 +198,13 @@ Future<Map<String, Object?>?> _answer(
       );
       return {'ways': ways.toJson()};
     case RegisterOperation.deleteAccount:
-      await register.deleteAccount(session, arguments.id('person'));
+      await register.deleteAccount(
+        session,
+        arguments.id('person'),
+        proof: arguments.has('proof')
+            ? arguments.model('proof', DeletionProof.fromJson)
+            : null,
+      );
       return const {};
     case RegisterOperation.knownAccounts:
       final known = await register.knownAccounts(
@@ -499,6 +505,9 @@ extension type const _Arguments(Map<String, Object?> _map) {
   ByteData? optionalBytes(String name) =>
       optionalString(name) == null ? null : bytes(name);
 
+  /// Whether the argument [name] holds anything (not null).
+  bool has(String name) => _map[name] != null;
+
   /// The model [read] makes of the object [name]; a [FormatException] for
   /// what isn't one.
   T model<T>(String name, T Function(Map<String, dynamic> json) read) {