feat(base): mending a broken SimpleLogin link with the handle and the recovery phrase (ADR 0020, D7)

Someone whose SimpleLogin identity is new to the register but who has an
account ("I already have one") names their handle and proves the
account's recovery phrase; the new identity takes the old one's place.

- `simpleLogin.beginMend(attempt, handle)`: the keys wrapped under the
  phrase's key, the public keys and a nonce, for the account with that
  handle (whatever its case). Only an account with keys and a SimpleLogin
  identity is mended, a link it had, as nobody adds SimpleLogin signed
  out (D10); a handle nobody has, or any other account's, gets a decoy
  from `signInDecoyKey`, the same each time. At most 10 an hour per
  handle and 30 per network.
- `simpleLogin.mend(attempt, proof)`: the phrase's proof for `mendLink`,
  binding the attempt (`mendLinkDigest`, on both sides), so a proof
  relayed from another sign-in links nobody's identity but the device's
  own; checked for the waiting identity first, which leaves the proof
  unspent. Every session of the account ends, in every service, and the
  sign-in stands ten minutes for a change, such as a lost password.
- SimpleLogin needs `SIGN_IN_DECOY_KEY` alone of ADR 0017's three keys
  (`signInDecoyKeyOf`); `addInstanceRoutes` stops a server with a
  SimpleLogin app and without it (`checkSimpleLoginMending`).
- Members ask the register for both; `RemoteRegister` and the instance
  API carry them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

deploy/.env.example

@@ -86,6 +86,7 @@ EMAIL_FROM=
 #   code (people make new ones once signed in).
 # SIGN_IN_DECOY_KEY makes the answers for addresses nobody has look like an account's:
 #   changing it lets someone who watched those answers tell which addresses are unused.
+#   SimpleLogin needs it alone (below), for handles nobody has.
 # Generate each: openssl rand -hex 32
 TOTP_KEY=
 RECOVERY_CODE_KEY=
@@ -96,6 +97,8 @@ SIGN_IN_DECOY_KEY=
 # (SimpleLogin → Settings → Developer → New website), registered with the callback
 # /simplelogin-callback on the server's web address (on learn.halkyon.eu's server
 # https://learn.halkyon.eu/simplelogin-callback), its forwarding page back to the apps.
+# Takes SIGN_IN_DECOY_KEY (above), or the server doesn't start: a broken link is mended
+# with the handle and the recovery phrase, a handle nobody has answered as an account's.
 SIMPLELOGIN_CLIENT_ID=
 SIMPLELOGIN_CLIENT_SECRET=
 # Another callback than this server's own page, as the app registered it (https only).