feat: sign in to a session, and end it at the canister

signIn asks for a session rather than a long-lived delegation, and what
comes back is restricted to Internet Identity — so a copy of it is worth
nothing against an application's own canisters, and the only thing it
can do is mint. maxTimeToLive keeps meaning the longest the thing being
granted may live; targets go, because what an application may call is
decided by the delegations minted from the session rather than by the
session itself.

It mints inside the ceremony the user is already waiting through, so the
first request afterwards does not wait. That mint is also where the
account's key comes from: the session chain is rooted at the session's
own key, and only a mint reports the key an application's canisters see.
A page load takes it from the stored app credential instead, and mints
where there is none — which such a load owes anyway.

signOut ends the session at the canister, so access stops within one
delegation lifetime instead of running to the session's expiry. The
revoke and the wipe run together: a slow or failing call must not hold
up a sign-out the user asked for, and only the wipe may fail it, because
the idle callback reloads on success alone and a reload after a failed
wipe would restore the session it just tried to end.

The identity provider becomes two values. A ceremony is rendered at a
URL and delegations are minted by a canister, and they are not the same
address.

Author: sea-snake