fix: address 3 PARTIAL plan items

#15 @context security vocab: actor JSON now uses actor_ap_context()
     which includes W3C security vocab + Mastodon toot extensions
     (manuallyApprovesFollowers, discoverable, featured).
     Applied to actor_handler, actor_json(), broadcast_actor_update().
     Activity JSON keeps plain AS context (no security vocab needed).

#17 HTTP Digest (documented, no code change): production mode
     (debug=false) REQUIRES Digest header on inbound POSTs via
     require_digest() in the non-compat normalization config.
     Added doc comment to ApFederationConfig::new() to clarify.

#26 Integration tests: 3 new tokio tests in src/tests/integration.rs
     using in-memory trait stubs. Tests cover:
     - check_guards idempotency (duplicate activity rejected)
     - check_guards domain block (blocked domain skipped)
     - extract_and_dispatch_mentions (on_mention called for local actor)

src/urls.rs

@@ -6,6 +6,24 @@ pub const AS_PUBLIC: &str = "https://www.w3.org/ns/activitystreams#Public";
 pub const AP_CONTEXT: &str = "https://www.w3.org/ns/activitystreams";
 pub const AP_PAGE_SIZE: usize = 20;
 
+/// Returns the `@context` array for actor AP JSON.
+/// Includes the W3C security vocabulary (needed for `publicKey` resolution)
+/// and common Mastodon/Toot extensions (`discoverable`, `featured`, etc.).
+/// Activities use `WithContext::new_default` (plain AS context) — only actor
+/// JSON needs the security vocab.
+pub fn actor_ap_context() -> serde_json::Value {
+    serde_json::json!([
+        "https://www.w3.org/ns/activitystreams",
+        "https://w3id.org/security/v1",
+        {
+            "manuallyApprovesFollowers": "as:manuallyApprovesFollowers",
+            "toot": "http://joinmastodon.org/ns#",
+            "discoverable": "toot:discoverable",
+            "featured": {"@id": "toot:featured", "@type": "@id"}
+        }
+    ])
+}
+
 pub fn extract_user_id_from_url(url: &Url) -> Option<uuid::Uuid> {
     let path = url.path();
     path.strip_prefix("/users/")