feat(auth): recover cross-signal authorization with provision secrets

A client that could not authorize against a foreign signal server was
redirected into a dead end with no way to retry, so servers joined from
another signal route became unreachable.

The home server now stores a per-user provision secret, clients keep it in
their own store, and a recovery service records why authorization failed per
server URL. Invite, server browser, and chat room surface that reason and
offer a retry instead of silently redirecting.

toju-app/src/app/domains/authentication/application/services/signal-server-authorize.service.ts

@@ -5,8 +5,6 @@ import { firstValueFrom } from 'rxjs';
 import { selectCurrentUser } from '../../../../store/users/users.selectors';
 import { ServerDirectoryFacade } from '../../../server-directory';
 import { AUTH_MODE_AUTHORIZE, buildLoginReturnQueryParams } from '../../domain/logic/auth-navigation.rules';
-import { isEndpointOnlineForConnection } from '../../../server-directory/domain/logic/server-endpoint-connectivity.rules';
-import { shouldNavigateToAuthorizeSignalServer } from '../../domain/logic/signal-server-authorize.rules';
 import { isSameSignalServerUrl } from '../../domain/logic/signal-server-auth-failure.rules';
 import { SignalServerAuthService } from './signal-server-auth.service';
 
@@ -50,31 +48,13 @@ export class SignalServerAuthorizeService {
       return true;
     }
 
-    const endpointStatus = await this.resolveEndpointStatusForAuthorize(serverUrl);
-
-    if (shouldNavigateToAuthorizeSignalServer(endpointStatus, result)) {
-      await this.navigateToAuthorize(serverUrl, this.router.url);
-    }
-
+    // Automatic recovery must never turn a healthy home session into a generic
+    // foreign-server login redirect. The contextual caller renders the
+    // per-server recovery action; explicit authorization remains available in
+    // Network settings.
     return false;
   }
 
-  private async resolveEndpointStatusForAuthorize(serverUrl: string) {
-    const endpoint = this.serverDirectory.findServerByUrl(serverUrl);
-
-    if (!endpoint) {
-      return null;
-    }
-
-    if (isEndpointOnlineForConnection(endpoint.status) || endpoint.status === 'offline' || endpoint.status === 'incompatible') {
-      return endpoint.status;
-    }
-
-    await this.serverDirectory.testServer(endpoint.id);
-
-    return this.serverDirectory.servers().find((candidate) => candidate.id === endpoint.id)?.status ?? endpoint.status;
-  }
-
   async navigateToAuthorize(serverUrl: string, returnUrl: string): Promise<void> {
     const endpoint = this.serverDirectory.ensureServerEndpoint({
       name: this.buildEndpointName(serverUrl),