Multi-homing: keep a mailbox at more than one relay

Federation let somebody at another relay write to you. It did not stop your
relay being the only place your mail lives — so relay1 going away took the
undelivered messages with it, and relay1 refusing to serve you locked you out
of your own inbox. That is the gap people actually mean by decentralised, and
it is what this closes.

An account registers the same devices, with the same identity keys, at several
relays and publishes a signed record naming them. A sender fans out to every
one. Any single relay can then be unreachable, hostile or gone and the message
still arrives, because it was never only there.

The record is signed by the ACCOUNT key, not asserted by a relay. A relay that
could edit the list would drop the others from it and become the sole delivery
target, which is precisely the position multi-homing exists to escape. A sending
relay verifies against the key the recipient's address decodes to — the address
IS the key — so it never has to trust what the relay it asked handed back.

The serial closes the half a signature does not. An OLD list is genuinely
signed: a relay could serve one from before a second home was added and it
would verify perfectly. Records may only move forward, and the test proves the
real attack rather than a forgery — publish serial 2, then replay the still
validly signed serial 1, and get a 409.

Envelopes carry a client-chosen id, identical in every copy, so a recipient
polling two relays sees one message rather than two. Nullable and not unique:
an envelope from an older client has none and must still be delivered, and two
rows legitimately share an id when one message goes to two devices.

`maxHomes` is 4 because a sender fans out to every entry, and a signed record
naming a thousand hosts would turn any sender's relay into an amplifier aimed
wherever the signer likes — with a signature making it look legitimate.

Verified on relay1/2/3.flamenet.io: 12 checks. Alice names only relay2, her
relay discovers relay3 from the signed record, and Bob reads the message from
either. Local suite 255.

⚠️ Delivery to an unreachable home is reported and NOT retried. A home that is
down when you send simply misses that message; closing that needs a queue and
this does not have one.

⚠️ Neither app calls any of this yet.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

engine/src/test/kotlin/io/flamenet/e2e/PublishedVectorsTest.kt

@@ -84,6 +84,29 @@ class PublishedVectorsTest {
         assertEquals(12, formatted.split(" ").size)
     }
 
+    @Test
+    fun `account identity encodes exactly as published`() {
+        val ai = vectors.getJSONObject("accountIdentity")
+        val key = java.util.Base64.getDecoder().decode(ai.getString("accountKeyB64"))
+
+        assertEquals(ai.getString("encoded"), FNID.encode(key))
+        assertEquals(ai.getString("address"), FNID.address(key))
+
+        val claim = ai.getJSONObject("claim")
+        val input = claim.getJSONObject("input")
+        assertEquals(
+            claim.getString("canonical"),
+            String(
+                FNID.claimCanonical(
+                    audience = input.getString("audience"),
+                    userId = input.getLong("userId"),
+                    accountKeyB64 = input.getString("accountKeyB64"),
+                ),
+                Charsets.UTF_8,
+            ),
+        )
+    }
+
     @Test
     fun `canonical leaf encodes and hashes exactly as published`() {
         val leaf = vectors.getJSONObject("keyLog").getJSONObject("canonicalLeaf")