feat(session): sign in with a handle, discovering the PDS

[ewanc26]

What this changes

Replaces #202 (which conflicted with main after the v0.39.0 pin landed; this is the same feature commit on a fresh branch from main, without the old pin commits).

App-password sign-in uses Wolfram's wf_agent_login_discovered: the account's PDS is read from its DID document and the login goes there, so the user does not type the host. An empty Server field starts from the default host.

Verification

Host: make check 1042 checks, 0 failures (includes the entry-host fallback check); make sweep ok. Pinned to Wolfram v0.39.0 on main. The .wuhb link was previously blocked by 64-bit atomics on the Wii U, fixed in v0.38.2. Not signed in against a live PDS here.

Docs

Docs: none (sign-in behaviour is described in the CHANGELOG entry).

Changelog: CHANGELOG.md

Checklist

• CI is green (CI gate and flow / conventions)
• No secrets, tokens or signing keys in the diff
• Tests added or changed with the behaviour; none skipped, disabled or deleted

🤖 Generated with Claude Code