refactor: 5 architectural improvements (Tasks 2-5 + Task 6 fix)

- feat(domain): Hashtag value object with canonical extract() — unifies two
  divergent private implementations; fields pre-compute raw/normalized/url_slug/ap_name

- feat(presentation): Deps<S: FromAppState> extractor — each handler now
  declares its exact dependency surface; AppState unchanged; handlers
  become unit-testable without mocking all 20 deps

- refactor(feed): replace 5 flat FeedRepository methods with FeedQuery/FeedScope
  — single query() method; SQL shared logic lives once; adding feed types
  no longer requires 5 edits

- refactor(activitypub): ActivityPubRepository + OutboundFederationPort moved
  out of domain::ports into activitypub-base::ap_ports — domain crate no
  longer knows about AP IDs, inboxes, or actor URLs

- fix(outbox): OutboxRelay now opens a per-row transaction so FOR UPDATE
  SKIP LOCKED actually holds the lock during publish + mark_delivered

crates/adapters/postgres/src/activitypub.rs

@@ -6,10 +6,10 @@ const THOUGHTS_PATH_PREFIX: &str = "/thoughts/";
 use chrono::{DateTime, Utc};
 use sqlx::PgPool;
 
+use activitypub_base::{ActivityPubRepository, ActorApUrls, OutboxEntry};
 use domain::{
     errors::DomainError,
     models::thought::{Thought, Visibility},
-    ports::{ActivityPubRepository, ActorApUrls, OutboxEntry},
     value_objects::{Content, ThoughtId, UserId, Username},
 };
 
@@ -328,7 +328,7 @@ impl ActivityPubRepository for PgActivityPubRepository {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use domain::ports::ActivityPubRepository;
+    use activitypub_base::ActivityPubRepository;
 
     #[sqlx::test(migrations = "./migrations")]
     async fn intern_remote_actor_is_idempotent(pool: sqlx::PgPool) {