refactor: 5 architectural improvements (Tasks 2-5 + Task 6 fix)

- feat(domain): Hashtag value object with canonical extract() — unifies two
  divergent private implementations; fields pre-compute raw/normalized/url_slug/ap_name

- feat(presentation): Deps<S: FromAppState> extractor — each handler now
  declares its exact dependency surface; AppState unchanged; handlers
  become unit-testable without mocking all 20 deps

- refactor(feed): replace 5 flat FeedRepository methods with FeedQuery/FeedScope
  — single query() method; SQL shared logic lives once; adding feed types
  no longer requires 5 edits

- refactor(activitypub): ActivityPubRepository + OutboundFederationPort moved
  out of domain::ports into activitypub-base::ap_ports — domain crate no
  longer knows about AP IDs, inboxes, or actor URLs

- fix(outbox): OutboxRelay now opens a per-row transaction so FOR UPDATE
  SKIP LOCKED actually holds the lock during publish + mark_delivered

crates/domain/src/ports.rs

@@ -317,37 +317,43 @@ impl<
 {
 }
 
+#[derive(Debug, Clone)]
+pub enum FeedScope {
+    Home { following_ids: Vec<UserId> },
+    Public,
+    Tag { tag_name: String },
+    User { user_id: UserId },
+    Search { query: String },
+}
+
+#[derive(Debug, Clone)]
+pub struct FeedQuery {
+    pub scope: FeedScope,
+    pub page: PageParams,
+    pub viewer_id: Option<UserId>,
+}
+
+impl FeedQuery {
+    pub fn home(viewer_id: UserId, following_ids: Vec<UserId>, page: PageParams) -> Self {
+        Self { scope: FeedScope::Home { following_ids }, page, viewer_id: Some(viewer_id) }
+    }
+    pub fn public(page: PageParams, viewer_id: Option<UserId>) -> Self {
+        Self { scope: FeedScope::Public, page, viewer_id }
+    }
+    pub fn tag(tag_name: impl Into<String>, page: PageParams, viewer_id: Option<UserId>) -> Self {
+        Self { scope: FeedScope::Tag { tag_name: tag_name.into() }, page, viewer_id }
+    }
+    pub fn user(user_id: UserId, page: PageParams, viewer_id: Option<UserId>) -> Self {
+        Self { scope: FeedScope::User { user_id }, page, viewer_id }
+    }
+    pub fn search(query: impl Into<String>, page: PageParams, viewer_id: Option<UserId>) -> Self {
+        Self { scope: FeedScope::Search { query: query.into() }, page, viewer_id }
+    }
+}
+
 #[async_trait]
 pub trait FeedRepository: Send + Sync {
-    async fn home_feed(
-        &self,
-        following_ids: &[UserId],
-        page: &PageParams,
-        viewer_id: Option<&UserId>,
-    ) -> Result<Paginated<FeedEntry>, DomainError>;
-    async fn public_feed(
-        &self,
-        page: &PageParams,
-        viewer_id: Option<&UserId>,
-    ) -> Result<Paginated<FeedEntry>, DomainError>;
-    async fn search(
-        &self,
-        query: &str,
-        page: &PageParams,
-        viewer_id: Option<&UserId>,
-    ) -> Result<Paginated<FeedEntry>, DomainError>;
-    async fn tag_feed(
-        &self,
-        tag_name: &str,
-        page: &PageParams,
-        viewer_id: Option<&UserId>,
-    ) -> Result<Paginated<FeedEntry>, DomainError>;
-    async fn user_feed(
-        &self,
-        user_id: &UserId,
-        page: &PageParams,
-        viewer_id: Option<&UserId>,
-    ) -> Result<Paginated<FeedEntry>, DomainError>;
+    async fn query(&self, q: &FeedQuery) -> Result<Paginated<FeedEntry>, DomainError>;
 }
 
 #[async_trait]
@@ -368,166 +374,6 @@ pub trait SearchPort: Send + Sync {
     ) -> Result<Paginated<User>, DomainError>;
 }
 
-/// AP-protocol endpoints for a locally-stored user (local or interned remote).
-#[derive(Debug, Clone)]
-pub struct ActorApUrls {
-    pub ap_id: String,
-    pub inbox_url: String,
-}
-
-/// A local thought ready for AP serialization, with the author's username
-/// pre-joined so the handler can build AP URLs without a second query.
-#[derive(Debug, Clone)]
-pub struct OutboxEntry {
-    pub thought: crate::models::thought::Thought,
-    pub author_username: Username,
-}
-
-#[async_trait]
-pub trait ActivityPubRepository: Send + Sync {
-    // ── Outbox (local → remote) ──────────────────────────────────────
-
-    /// All public local thoughts for this actor. Used for outbox totals
-    /// and full-collection delivery.
-    async fn outbox_entries_for_actor(
-        &self,
-        user_id: &UserId,
-    ) -> Result<Vec<OutboxEntry>, DomainError>;
-
-    /// Cursor page of public local thoughts, newest-first, before `before`.
-    /// Used for OrderedCollectionPage responses.
-    async fn outbox_page_for_actor(
-        &self,
-        user_id: &UserId,
-        before: Option<chrono::DateTime<chrono::Utc>>,
-        limit: usize,
-    ) -> Result<Vec<OutboxEntry>, DomainError>;
-
-    // ── Remote actor resolution ──────────────────────────────────────
-
-    /// Find the local UserId for a remote actor by its AP URL.
-    async fn find_remote_actor_id(&self, actor_ap_url: &str)
-        -> Result<Option<UserId>, DomainError>;
-
-    /// Ensure a remote actor placeholder exists; create one if absent.
-    /// Idempotent — safe to call multiple times with the same URL.
-    async fn intern_remote_actor(&self, actor_ap_url: &str) -> Result<UserId, DomainError>;
-
-    /// Update display_name and avatar_url for an already-interned remote actor.
-    async fn update_remote_actor_display(
-        &self,
-        user_id: &UserId,
-        display_name: Option<&str>,
-        avatar_url: Option<&str>,
-    ) -> Result<(), DomainError>;
-
-    // ── Inbox processing (remote → local) ───────────────────────────
-
-    /// Persist an incoming remote Note. Idempotent on ap_id.
-    #[allow(clippy::too_many_arguments)]
-    async fn accept_note(
-        &self,
-        ap_id: &str,
-        author_id: &UserId,
-        content: &str,
-        published: chrono::DateTime<chrono::Utc>,
-        sensitive: bool,
-        content_warning: Option<String>,
-        visibility: &str,
-        in_reply_to: Option<&str>,
-    ) -> Result<(), DomainError>;
-
-    /// Apply an Update to a previously accepted remote Note.
-    async fn apply_note_update(&self, ap_id: &str, new_content: &str) -> Result<(), DomainError>;
-
-    /// Remove a specific remote Note (Delete activity). Only touches
-    /// remotely-originated thoughts.
-    async fn retract_note(&self, ap_id: &str) -> Result<(), DomainError>;
-
-    /// Remove all Notes from a remote actor (actor-level Delete/Tombstone).
-    async fn retract_actor_notes(&self, actor_ap_url: &str) -> Result<(), DomainError>;
-
-    // ── Node-level stats ─────────────────────────────────────────────
-
-    /// Total locally-authored thought count for NodeInfo responses.
-    async fn count_local_notes(&self) -> Result<u64, DomainError>;
-
-    /// Return the ActivityPub object URL for a thought, if one is stored.
-    /// Returns None for local thoughts (caller constructs URL from base_url + thought_id).
-    async fn get_thought_ap_id(
-        &self,
-        thought_id: &ThoughtId,
-    ) -> Result<Option<String>, DomainError>;
-
-    /// Return the AP actor URL and inbox URL for a user, if stored.
-    /// Returns None for users that have not been federated.
-    async fn get_actor_ap_urls(&self, user_id: &UserId)
-        -> Result<Option<ActorApUrls>, DomainError>;
-}
-
-#[async_trait]
-pub trait OutboundFederationPort: Send + Sync {
-    /// Fan out a new local Note to all accepted followers.
-    async fn broadcast_create(
-        &self,
-        author_user_id: &UserId,
-        thought: &Thought,
-        author_username: &str,
-        in_reply_to_url: Option<&str>,
-    ) -> Result<(), DomainError>;
-
-    /// Fan out a Delete tombstone for a now-deleted local Note.
-    /// `thought_ap_id` is pre-constructed by the caller because the thought
-    /// has already been deleted from the DB when this fires.
-    async fn broadcast_delete(
-        &self,
-        author_user_id: &UserId,
-        thought_ap_id: &str,
-    ) -> Result<(), DomainError>;
-
-    /// Fan out an Update(Note) for an edited local thought.
-    async fn broadcast_update(
-        &self,
-        author_user_id: &UserId,
-        thought: &Thought,
-        author_username: &str,
-        in_reply_to_url: Option<&str>,
-    ) -> Result<(), DomainError>;
-
-    /// Fan out an Announce(object_ap_id) for a boost.
-    async fn broadcast_announce(
-        &self,
-        booster_user_id: &UserId,
-        object_ap_id: &str,
-    ) -> Result<(), DomainError>;
-
-    /// Fan out an Undo(Announce) to followers when a boost is removed.
-    async fn broadcast_undo_announce(
-        &self,
-        booster_user_id: &UserId,
-        object_ap_id: &str,
-    ) -> Result<(), DomainError>;
-
-    /// Send a Like activity to a remote thought author's inbox.
-    /// Only called when a LOCAL user likes a REMOTE thought (one with an ap_id).
-    async fn broadcast_like(
-        &self,
-        liker_user_id: &UserId,
-        object_ap_id: &str,
-        author_inbox_url: &str,
-    ) -> Result<(), DomainError>;
-
-    /// Send Undo(Like) to a remote thought author's inbox.
-    async fn broadcast_undo_like(
-        &self,
-        liker_user_id: &UserId,
-        object_ap_id: &str,
-        author_inbox_url: &str,
-    ) -> Result<(), DomainError>;
-
-    /// Fan out an Update(Actor) to all accepted followers after a profile change.
-    async fn broadcast_actor_update(&self, user_id: &UserId) -> Result<(), DomainError>;
-}
 
 #[async_trait]
 pub trait FederationSchedulerPort: Send + Sync {