What signing in to tcm servers asks of an account's PDS: service-auth tokens for SERVE_LXM, addressed to any server (each token names the one it's for).
A sign-in for `scope`, as `who` (a handle or DID) or, without one, the one used last: kept from before (its tokens refreshed if they've expired), or a new one, kept for next time (in tcmSessions): with the app password in `TCM_ATPROTO_APP_PASSWORD` if it's set (no browser, and never again, as it signs in again by itself), else in the browser, for the scopes the kept one had as well. A kept app password's sign-in covers every scope.