feat(activitypub): phase 1 — discoverable/fetchable actor (WebFinger, Actor, Outbox, Notes)
First step of real ActivityPub federation: per-site RSA keys, WebFinger,
a content-negotiated Actor document (AP-JSON for servers, redirect to the HTML
profile for browsers), Outbox (Create/Note) and Note objects under /ap/*.
Inbox is a 202 stub for now; Follow/Accept + HTTP-signature verify + delivery
to followers land in the next step (tested live against Mastodon).
Co-Authored-By: Claude <noreply@…>