feat(session): sign in with a handle, discovering the PDS

[ewanc26]

What this changes

App-password sign-in uses Wolfram's wf_agent_login_discovered: the PDS is read from the handle's DID document and the login goes there, so the user no longer types the host. An empty Server field starts from the default host.

Wolfram v0.38.0 is released and pinned.

Verification

Host: make check 1022 checks, 0 failures (the new check covers the entry-host fallback); make sweep and make linkcheck pass against the Wolfram branch. Not signed in against a live PDS here.

Docs

CHANGELOG entry.

Changelog: CHANGELOG.md

Checklist

• CI is green (CI gate and flow / conventions)
• No secrets, tokens or signing keys in the diff
• Tests added or changed with the behaviour; none skipped, disabled or deleted

🤖 Generated with Claude Code

[ewanc26]

Superseded by #207: the same feature commit on a fresh branch from main, because #202 conflicted with main after the v0.39.0 pin landed and a rebase would need a force-push.