feat: production hardening — security, scale, protocol, DX

Breaking changes to FederationRepository, ApObjectHandler, ApUser:

FederationRepository:
- add is_activity_processed / mark_activity_processed (inbox idempotency)
- add get_accepted_follower_inboxes (DB-side dedup/filtering, replaces in-memory load-all)

ApObjectHandler:
- add on_announce_of_remote (cross-server boosts, previously silently dropped)

ApUser:
- add manually_approves_followers: bool
- add actor_type: ApActorType (was hardcoded Person)

Security:
- block check before actor HTTP fetch in Follow (prevents SSRF on blocked actors)
- 4xx responses use generic "not found"/"bad request" (no internal leak)
- 1 MB DefaultBodyLimit on inbox routes
- zeroize private key after generation

Delivery:
- all broadcasts are now non-blocking (tokio::spawn fallback, or EventPublisher queue)
- EventPublisher redesigned with typed FederationEvent enum (DeliveryRequested/DeliveryFailed)
- new deliver_to_inbox() public method for queue consumers
- configurable delivery_max_attempts and delivery_initial_delay_secs via builder
- Follow saved as Pending BEFORE delivery (race condition fix)

Router:
- GET /users/{id} (actor), GET /users/{id}/followers, GET /users/{id}/following now mounted

Protocol:
- mention extraction from Create/Update tag arrays → on_mention() dispatched
- WebFinger: add aliases field (acct: URI + AP actor URL)
- outbox: add last link, use count_local_posts for totalItems
- idempotency guard added to every inbound activity receive()
- actor serializes display_name and configurable actor_type/manually_approves_followers

Bump: 0.1.10 → 0.2.0

src/actor_handler.rs

@@ -7,18 +7,16 @@ use crate::actors::{Person, get_local_actor};
 use crate::data::FederationData;
 use crate::error::Error;
 
+/// Serves the AP actor JSON for a local user.
+/// The path parameter is the user's UUID (matching the canonical actor URL).
 pub async fn actor_handler(
-    Path(username): Path<String>,
+    Path(user_id_str): Path<String>,
     data: Data<FederationData>,
 ) -> Result<FederationJson<WithContext<Person>>, Error> {
-    let ap_user = data
-        .user_repo
-        .find_by_username(&username)
-        .await
-        .map_err(Error::from)?
-        .ok_or_else(|| Error::bad_request(anyhow::anyhow!("user not found")))?;
+    let user_id = uuid::Uuid::parse_str(&user_id_str)
+        .map_err(|_| Error::not_found(anyhow::anyhow!("user not found")))?;
 
-    let db_actor = get_local_actor(ap_user.id, &data).await?;
+    let db_actor = get_local_actor(user_id, &data).await?;
     let person = db_actor.into_json(&data).await?;
 
     Ok(FederationJson(WithContext::new_default(person)))