feat(ap): ActivityPub spec compliance and profile completeness

Phase 1 — spec compliance:
- Add AS_PUBLIC constant; add to/cc fields to CreateActivity, DeleteActivity,
  UpdateActivity, AddActivity; populate on all broadcast call sites
- Add @context to outbox CreateActivity items
- Set manuallyApprovesFollowers: true to match actual Pending follow flow
- Gate PermissiveVerifier behind FEDERATION_DEBUG env var
- Add updated timestamp to Person actor JSON
- Improve actor update delivery logging

Phase 2a Batch 1 — AP layer:
- Add /inbox shared inbox route; add endpoints.sharedInbox to Person
- Paginate followers and following collections (20/page, OrderedCollectionPage)

Phase 2a Batch 2 — profile completeness:
- DB migrations: banner_path, also_known_as columns; user_profile_fields table
- ProfileField value object; UserProfileFieldsRepository port
- Banner image upload (stored via image-converter, surfaced as image in Person)
- alsoKnownAs field in Person (account migration support)
- Custom profile fields (up to 4 PropertyValue attachments in Person)
- Profile settings UI: banner preview/upload, alsoKnownAs input, fields form
- PUT /api/v1/profile/fields API endpoint

crates/adapters/activitypub/src/lib.rs

@@ -31,6 +31,7 @@ pub async fn wire(
     review_store:          std::sync::Arc<dyn RemoteReviewRepository>,
     remote_watchlist_repo: std::sync::Arc<dyn domain::ports::RemoteWatchlistRepository>,
     user_repo:             std::sync::Arc<dyn domain::ports::UserRepository>,
+    profile_fields_repo:   std::sync::Arc<dyn domain::ports::UserProfileFieldsRepository>,
     movie_repo:            std::sync::Arc<dyn domain::ports::MovieRepository>,
     review_repo:           std::sync::Arc<dyn domain::ports::ReviewRepository>,
     diary_repo:            std::sync::Arc<dyn domain::ports::DiaryRepository>,
@@ -52,15 +53,26 @@ pub async fn wire(
         watchlist: watchlist_handler,
     });
 
+    let federation_debug = std::env::var("FEDERATION_DEBUG")
+        .map(|v| v == "true" || v == "1")
+        .unwrap_or(false);
+
+    if federation_debug {
+        tracing::warn!(
+            "federation running in DEBUG mode — PermissiveVerifier active, \
+             no URL/signature validation. Do NOT use in production."
+        );
+    }
+
     let concrete = std::sync::Arc::new(
         ActivityPubService::new(
             federation_repo,
-            std::sync::Arc::new(DomainUserRepoAdapter::new(user_repo, base_url.clone())),
+            std::sync::Arc::new(DomainUserRepoAdapter::new(user_repo, profile_fields_repo, base_url.clone())),
             composite,
             base_url.clone(),
             allow_registration,
             "movies-diary".to_string(),
-            cfg!(debug_assertions),
+            federation_debug,
             Some(event_publisher),
         )
         .await?,