feat(auth): ways in for accounts without a working password

ADR 0017, step 3. Signing up takes an address a mailed code proves and
a password's setup, without a session (`passwordSignIn.signUp`): an
address nobody has becomes a new identified account, and an account
with the address but no password (codes by mail before; no keys exist,
so nothing waits) takes the password, keeping its ID. A setup never
finished signs in with its password and a code mailed to the address it
began with, until an authenticator is confirmed, which also calls off a
reset of the account waiting; any other account takes no code by mail
in place of its second factor and leaves the code unused. A reset of
the whole account waiting no longer counts as having had an
authenticator, so its owner isn't locked out until it completes.

Members forward both through the register; the tests' shared helpers
move into `support/password_support.dart`.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_server/lib/src/register/instance_api.dart

@@ -247,8 +247,18 @@ Future<Map<String, Object?>?> _answer(
         clientProof: arguments.bytes('clientProof'),
         totpCode: arguments.optionalString('totpCode'),
         recoveryCode: arguments.optionalString('recoveryCode'),
+        request: arguments.optionalId('request'),
+        code: arguments.optionalString('code'),
       );
       return {'proof': proof.toJson()};
+    case RegisterOperation.signUpWithCode:
+      final account = await register.signUpWithCode(
+        session,
+        request: arguments.id('request'),
+        code: arguments.string('code'),
+        setup: arguments.model('setup', PasswordSetup.fromJson),
+      );
+      return {'account': account.uuid};
     case RegisterOperation.enrolAuthenticator:
       final enrolment = await register.enrolAuthenticator(
         session,