feat(ap): ActivityPub spec compliance and profile completeness

Phase 1 — spec compliance:
- Add AS_PUBLIC constant; add to/cc fields to CreateActivity, DeleteActivity,
  UpdateActivity, AddActivity; populate on all broadcast call sites
- Add @context to outbox CreateActivity items
- Set manuallyApprovesFollowers: true to match actual Pending follow flow
- Gate PermissiveVerifier behind FEDERATION_DEBUG env var
- Add updated timestamp to Person actor JSON
- Improve actor update delivery logging

Phase 2a Batch 1 — AP layer:
- Add /inbox shared inbox route; add endpoints.sharedInbox to Person
- Paginate followers and following collections (20/page, OrderedCollectionPage)

Phase 2a Batch 2 — profile completeness:
- DB migrations: banner_path, also_known_as columns; user_profile_fields table
- ProfileField value object; UserProfileFieldsRepository port
- Banner image upload (stored via image-converter, surfaced as image in Person)
- alsoKnownAs field in Person (account migration support)
- Custom profile fields (up to 4 PropertyValue attachments in Person)
- Profile settings UI: banner preview/upload, alsoKnownAs input, fields form
- PUT /api/v1/profile/fields API endpoint

crates/application/src/use_cases/mod.rs

@@ -24,6 +24,7 @@ pub mod register;
 pub mod search;
 pub mod sync_poster;
 pub mod update_profile;
+pub mod update_profile_fields;
 pub mod add_to_watchlist;
 pub mod remove_from_watchlist;
 pub mod get_watchlist;

crates/application/src/use_cases/update_profile.rs

@@ -15,33 +15,46 @@ pub async fn execute(ctx: &AppContext, cmd: UpdateProfileCommand) -> Result<(),
         .await?
         .ok_or_else(|| DomainError::NotFound("User not found".into()))?;
 
+    // Handle avatar
     let new_avatar_path = if let Some(bytes) = cmd.avatar_bytes {
         let content_type = cmd.avatar_content_type.as_deref().unwrap_or("");
         if !["image/jpeg", "image/png", "image/webp"].contains(&content_type) {
-            return Err(DomainError::ValidationError(
-                "Avatar must be jpeg, png, or webp".into(),
-            ));
+            return Err(DomainError::ValidationError("Avatar must be jpeg, png, or webp".into()));
         }
         if let Some(old_path) = user.avatar_path() {
             let _ = ctx.image_storage.delete(old_path).await;
         }
         let key = format!("avatars/{}", user_id.value());
         let stored = ctx.image_storage.store(&key, &bytes).await?;
-
-        if let Err(e) = ctx.event_publisher
-            .publish(&DomainEvent::ImageStored { key: stored.clone() })
-            .await
-        {
-            tracing::warn!("failed to emit ImageStored for {stored}: {e}");
+        if let Err(e) = ctx.event_publisher.publish(&DomainEvent::ImageStored { key: stored.clone() }).await {
+            tracing::warn!("failed to emit ImageStored for avatar {stored}: {e}");
         }
-
         Some(stored)
     } else {
         user.avatar_path().map(|s| s.to_string())
     };
 
+    // Handle banner
+    let new_banner_path = if let Some(bytes) = cmd.banner_bytes {
+        let content_type = cmd.banner_content_type.as_deref().unwrap_or("");
+        if !["image/jpeg", "image/png", "image/webp"].contains(&content_type) {
+            return Err(DomainError::ValidationError("Banner must be jpeg, png, or webp".into()));
+        }
+        if let Some(old_path) = user.banner_path() {
+            let _ = ctx.image_storage.delete(old_path).await;
+        }
+        let key = format!("banners/{}", user_id.value());
+        let stored = ctx.image_storage.store(&key, &bytes).await?;
+        if let Err(e) = ctx.event_publisher.publish(&DomainEvent::ImageStored { key: stored.clone() }).await {
+            tracing::warn!("failed to emit ImageStored for banner {stored}: {e}");
+        }
+        Some(stored)
+    } else {
+        user.banner_path().map(|s| s.to_string())
+    };
+
     ctx.user_repository
-        .update_profile(&user_id, cmd.bio, new_avatar_path)
+        .update_profile(&user_id, cmd.bio, new_avatar_path, new_banner_path, cmd.also_known_as)
         .await?;
 
     ctx.event_publisher

crates/application/src/use_cases/update_profile_fields.rs

@@ -0,0 +1,17 @@
+use domain::{
+    errors::DomainError,
+    events::DomainEvent,
+    value_objects::UserId,
+};
+
+use crate::{commands::UpdateProfileFieldsCommand, context::AppContext};
+
+pub async fn execute(ctx: &AppContext, cmd: UpdateProfileFieldsCommand) -> Result<(), DomainError> {
+    if cmd.fields.len() > 4 {
+        return Err(DomainError::ValidationError("Maximum 4 profile fields allowed".into()));
+    }
+    let user_id = UserId::from_uuid(cmd.user_id);
+    ctx.profile_fields_repository.set_fields(&user_id, cmd.fields).await?;
+    ctx.event_publisher.publish(&DomainEvent::UserUpdated { user_id }).await?;
+    Ok(())
+}