A sign-in flow's expiry sentences live in one module, read by the parent sign-in and an app's scaffold #5585

For: A sign-in that started elsewhere or ran out of time reads the same wherever it is said, because it is said from one place. Today each sentence below is typed out separately in src/http/rp.ts, src/apps/scaffold.ts, so the next edit to one copy makes them drift.

Done:

• [ ] src/kernel/signin_words.ts exports these sentences (new, or the existing module of that concept if one already owns similar words; say which in the pull):

- "This sign-in did not start in this browser." - "This sign-in took too long or was already used."

• [ ] Every file named imports them, and grep -rn for each sentence under src/ finds only the module.
• [ ] Answers and pages are byte-for-byte unchanged: every existing test passes as it is.
• [ ] A new test/signin-words.test.ts asserts each exported sentence is non-empty and that each file named no longer contains the literal (read the source as text). It fails if a copy is typed back.
• [ ] Before pushing, run test/signin-words.test.ts, the tests of the files you touched, bun x tsc --noEmit and, if src/web changed, bun scripts/design-lint.ts. A red test elsewhere that main also has is named in the pull, not a reason to stop.

Files: src/kernel/signin_words.ts, src/http/rp.ts, src/apps/scaffold.ts, test/signin-words.test.ts. Risk: a pure move; change no wording. Touch only the lines the sentences are on.