feat(ap): ActivityPub spec compliance and profile completeness

Phase 1 — spec compliance:
- Add AS_PUBLIC constant; add to/cc fields to CreateActivity, DeleteActivity,
  UpdateActivity, AddActivity; populate on all broadcast call sites
- Add @context to outbox CreateActivity items
- Set manuallyApprovesFollowers: true to match actual Pending follow flow
- Gate PermissiveVerifier behind FEDERATION_DEBUG env var
- Add updated timestamp to Person actor JSON
- Improve actor update delivery logging

Phase 2a Batch 1 — AP layer:
- Add /inbox shared inbox route; add endpoints.sharedInbox to Person
- Paginate followers and following collections (20/page, OrderedCollectionPage)

Phase 2a Batch 2 — profile completeness:
- DB migrations: banner_path, also_known_as columns; user_profile_fields table
- ProfileField value object; UserProfileFieldsRepository port
- Banner image upload (stored via image-converter, surfaced as image in Person)
- alsoKnownAs field in Person (account migration support)
- Custom profile fields (up to 4 PropertyValue attachments in Person)
- Profile settings UI: banner preview/upload, alsoKnownAs input, fields form
- PUT /api/v1/profile/fields API endpoint

crates/adapters/activitypub/src/tests/objects.rs

@@ -39,3 +39,52 @@ fn review_to_ap_object_includes_two_hashtags() {
     assert!(names.contains(&"#MoviesDiary"));
     assert!(names.contains(&"#Dune"));
 }
+
+#[test]
+fn review_to_ap_object_has_public_addressing() {
+    use chrono::NaiveDateTime;
+    use domain::{
+        models::{Review, ReviewSource},
+        value_objects::{MovieId, Rating, ReviewId, UserId},
+    };
+
+    let review = Review::from_persistence(
+        ReviewId::generate(),
+        MovieId::from_uuid(uuid::Uuid::new_v4()),
+        UserId::from_uuid(uuid::Uuid::new_v4()),
+        Rating::new(3).unwrap(),
+        None,
+        NaiveDateTime::parse_from_str("2024-06-01 00:00:00", "%Y-%m-%d %H:%M:%S").unwrap(),
+        NaiveDateTime::parse_from_str("2024-06-01 00:00:00", "%Y-%m-%d %H:%M:%S").unwrap(),
+        ReviewSource::Local,
+    );
+    let actor_url: url::Url = "https://example.com/users/abc".parse().unwrap();
+    let obj = review_to_ap_object(
+        &review,
+        "https://example.com/reviews/1".parse().unwrap(),
+        actor_url.clone(),
+        "Dune".to_string(),
+        2021,
+        None,
+        "https://example.com",
+    );
+    assert_eq!(obj.to, vec!["https://www.w3.org/ns/activitystreams#Public"]);
+    assert_eq!(obj.cc, vec!["https://example.com/users/abc/followers"]);
+}
+
+#[test]
+fn watchlist_to_ap_object_has_public_addressing() {
+    let actor_url: url::Url = "https://example.com/users/abc".parse().unwrap();
+    let obj = watchlist_to_ap_object(
+        "https://example.com/watchlist/1".parse().unwrap(),
+        actor_url.clone(),
+        "Alien".to_string(),
+        1979,
+        None,
+        None,
+        chrono::Utc::now(),
+        "https://example.com",
+    );
+    assert_eq!(obj.to, vec!["https://www.w3.org/ns/activitystreams#Public"]);
+    assert_eq!(obj.cc, vec!["https://example.com/users/abc/followers"]);
+}