#15 @context security vocab: actor JSON now uses actor_ap_context()
which includes W3C security vocab + Mastodon toot extensions
(manuallyApprovesFollowers, discoverable, featured).
Applied to actor_handler, actor_json(), broadcast_actor_update().
Activity JSON keeps plain AS context (no security vocab needed).
#17 HTTP Digest (documented, no code change): production mode
(debug=false) REQUIRES Digest header on inbound POSTs via
require_digest() in the non-compat normalization config.
Added doc comment to ApFederationConfig::new() to clarify.
#26 Integration tests: 3 new tokio tests in src/tests/integration.rs
using in-memory trait stubs. Tests cover:
- check_guards idempotency (duplicate activity rejected)
- check_guards domain block (blocked domain skipped)
- extract_and_dispatch_mentions (on_mention called for local actor)
#18 featured collection: add featured_url to ApUser/DbActor/Person;
serialized as featured field in AP JSON when set by consumer.
#19 Tombstone in Delete: broadcast_delete_to_followers now sends
{"type":"Tombstone","id":"..."} instead of bare URL string.
#21 Backfill pagination: run_backfill uses get_local_objects_page
with cursor-based loop — avoids loading all posts into memory;
delivers newest-to-oldest in BATCH_SIZE chunks.
