feat(auth): recover cross-signal authorization with provision secrets

A client that could not authorize against a foreign signal server was
redirected into a dead end with no way to retry, so servers joined from
another signal route became unreachable.

The home server now stores a per-user provision secret, clients keep it in
their own store, and a recovery service records why authorization failed per
server URL. Invite, server browser, and chat room surface that reason and
offer a retry instead of silently redirecting.

server/src/cqrs/commands/handlers/updateUserProvisionSecret.ts

@@ -0,0 +1,12 @@
+import { DataSource } from 'typeorm';
+import { AuthUserEntity } from '../../../entities';
+
+export async function handleUpdateUserProvisionSecret(
+  dataSource: DataSource,
+  userId: string,
+  provisionSecret: string
+): Promise<void> {
+  const repo = dataSource.getRepository(AuthUserEntity);
+
+  await repo.update({ id: userId }, { provisionSecret });
+}