refactor(realism): single source of truth for persona→login

decnet/realism/naming._home and decnet/canary/cultivator._persona_login
both normalised "John Smith"→"johnsmith" with identical logic. Lift
to decnet.realism.personas.login_for(persona) and have both consumers
import it. Drift between the two would have left canary placement and
realism path naming using different login derivations.

pyproject.toml

@@ -39,7 +39,10 @@ dependencies = [
     "httpx>=0.28.1",
     "requests>=2.33.1",
     "slowapi>=0.1.9",
-    "sqlite_vec>=0.1.9"
+    "sqlite_vec>=0.1.9",
+    "Pillow>=12.2.0",
+    "lxml>=6.1.0",
+    "pikepdf>=10.5.1",
 ]
 
 [project.optional-dependencies]