SsrfVerifier rejects private/reserved IPs (loopback, RFC1918, link-local,
CGNAT, ULA) on all federation fetches. Raw reqwest calls in webfinger and
backfill also validated. Debug mode bypasses via PermissiveVerifier.
Closes#4
#1 count_accepted_followers / get_accepted_followers_page: new DB-side
methods on FollowRepository — no more loading all followers into memory
to count or page them.
#2 Move re-follows are now non-blocking: tokio::spawn instead of
awaiting each sign_and_send inside receive() — inbox handler no longer
stalls for slow remote servers during account migration.
#3 Remove get_local_objects_for_user from ApContentReader (dead code).
Backfill and outbox both use the paginated get_local_objects_page.
#6 Rename backfill_outbox → import_remote_outbox with a clear doc
explaining the direction (import FROM a remote server, not to a follower).
#7 also_known_as: Option<String> → Vec<String> on ApUser, LookedUpActor,
and DbActor. from_json now stores all aliases; move_act.rs checks all.
Mentions: broadcast_create_note / broadcast_update_note now accept
mentioned_inboxes: Vec<Url> — delivery goes to followers + mentioned
actors who aren't already followers. Deduplication is done before
sending. Pass vec![] if note has no external mentions.
Docs: ApObjectHandler and ApContentReader now have complete doc comments
with contracts, idempotency guidance, and error-handling semantics.
#18 featured collection: add featured_url to ApUser/DbActor/Person;
serialized as featured field in AP JSON when set by consumer.
#19 Tombstone in Delete: broadcast_delete_to_followers now sends
{"type":"Tombstone","id":"..."} instead of bare URL string.
#21 Backfill pagination: run_backfill uses get_local_objects_page
with cursor-based loop — avoids loading all posts into memory;
delivers newest-to-oldest in BATCH_SIZE chunks.
