Rekey ceremony mailbox

This host is the opaque ceremony SaaS (never KEY/PAY plaintext).

Organizers and members run the local Rekey agent:

rekey-agent ui

Members open their personal /join/<ceremony>/<party>/page link.