Make federation a deliberate per-server act, with nothing enabled by default

[iderex]

The position in #68 allows exactly one way for data to reach a second host, which
is an operator deliberately federating with a server they chose. Deliberate is
doing a lot of work in that sentence, so it needs a definition an implementation
can be checked against.

The failure this prevents is the ordinary one. A setting defaulted to on, a
consent screen everybody agrees to without reading, or a pairing that quietly
covers everything once it covers anything.

What this produces

A definition of deliberate. Off unless switched on, per second server rather than
globally, naming what will be shared before it is shared, and reversible.

Scope. Federating for one purpose does not federate for another. What is shared
is enumerated at the time of the act rather than described in general.

A record on the device of what was federated and when, readable by the operator,
so that the answer to what has been shared is a fact rather than a memory.

Revocation, and a stated answer for what happens to data already sent, which is
usually that the core cannot recall it and should say so plainly.

Done when

The definition is recorded, no federation is active in a default configuration,
enabling one server leaves another untouched in a test, and revocation is proven
to stop further sharing. Blocked on #68.

[iderex]

The definition landed as docs/decisions/0072-federation-is-a-deliberate-per-server-act.md, on 02d9b5d.

It answers the four parts this issue asks for. Off unless switched on, with no default partner, no discovery and no server made reachable because another server mentioned it. Per second server, so the set is a list of acts rather than a setting whose value is "federate". Named before shared, in terms of the personal data list in 0068, with the enumeration binding afterwards. Reversible from the device, without the partner agreeing and without the network working.

It also settles three things this issue names but does not decide. Widening an existing act is a new act, so the device shows two entries rather than one that changed shape. The device keeps an append-only list of what was federated and when, including acts later revoked, since somebody asking has usually just remembered something they did once. And revocation stops further sharing while saying plainly that data already sent cannot be recalled; an offer to ask the other host to delete it is refused in the record, because the difference between asking and it being gone is invisible in an interface at the moment it matters.

Three of the four conditions here are untouched, and none of them is reachable in this tree. No federation active in a default configuration, one server enabled without touching another, and revocation proven to stop further sharing are all statements about running code. There is no language chosen, no build and no test command, so there is nothing to assert them against and no run that would go red if the record were violated. That state is the same one 0068 states for its own rule.

So this stays open on those three, and whoever writes the first request towards a partner is the first person able to prove any of them.