fix: address 3 PARTIAL plan items

#15 @context security vocab: actor JSON now uses actor_ap_context()
     which includes W3C security vocab + Mastodon toot extensions
     (manuallyApprovesFollowers, discoverable, featured).
     Applied to actor_handler, actor_json(), broadcast_actor_update().
     Activity JSON keeps plain AS context (no security vocab needed).

#17 HTTP Digest (documented, no code change): production mode
     (debug=false) REQUIRES Digest header on inbound POSTs via
     require_digest() in the non-compat normalization config.
     Added doc comment to ApFederationConfig::new() to clarify.

#26 Integration tests: 3 new tokio tests in src/tests/integration.rs
     using in-memory trait stubs. Tests cover:
     - check_guards idempotency (duplicate activity rejected)
     - check_guards domain block (blocked domain skipped)
     - extract_and_dispatch_mentions (on_mention called for local actor)

src/actor_handler.rs

@@ -6,6 +6,7 @@ use axum::extract::Path;
 use crate::actors::{Person, get_local_actor};
 use crate::data::FederationData;
 use crate::error::Error;
+use crate::urls::actor_ap_context;
 
 /// Serves the AP actor JSON for a local user.
 /// The path parameter is the user's UUID (matching the canonical actor URL).
@@ -19,5 +20,5 @@ pub async fn actor_handler(
     let db_actor = get_local_actor(user_id, &data).await?;
     let person = db_actor.into_json(&data).await?;
 
-    Ok(FederationJson(WithContext::new_default(person)))
+    Ok(FederationJson(WithContext::new(person, actor_ap_context())))
 }