gRPC Accounts: Provision from pre-derived SCRAM verifiers

Adds Accounts.Provision(name, scram256, scram512, email) so an external
authority that stores verifiers rather than passwords (a website) can bulk-
backfill accounts it never had the plaintext for. It creates the account
with the given SCRAM verifiers — SCRAM and keycard login work immediately;
typed-password login stays disabled (empty password_hash) until a real
password lands via Register/SetPassword. Refuses an existing account, so a
re-run can't clobber a fully-credentialed one. scram512 may be empty
(SCRAM-SHA-512 then falls back to 256).

src/engine/mod.rs

@@ -406,6 +406,16 @@ impl Engine {
         Ok(())
     }
 
+    // Provision an account from pre-derived SCRAM verifiers (bulk backfill from
+    // the authority). No email confirmation — the authority already vouches for it.
+    pub fn authority_provision(&mut self, name: &str, scram256: &str, scram512: &str, email: Option<String>) -> AuthorityStatus {
+        match self.db.provision_account(name, scram256, scram512, email) {
+            Ok(()) => AuthorityStatus::Ok,
+            Err(RegError::Exists) => AuthorityStatus::AlreadyExists,
+            Err(_) => AuthorityStatus::Internal,
+        }
+    }
+
     pub fn authority_register(&mut self, name: &str, creds: Option<db::Credentials>, email: Option<String>) -> AuthorityStatus {
         let Some(creds) = creds else { return AuthorityStatus::Internal };
         let addr = email.clone();