- Add verify() to Accept/Reject (actor must match Follow target)
- Add verify() to Create/Update (actor must match attributedTo)
- Add verify() to Delete (actor domain must match object domain)
- Fix UpdateActivity passing wrapper id instead of object id to on_update
- Implement on_unlike (was no-op stub) — publishes LikeRemoved event
- BlockActivity now removes remote actor as follower, not just following
- Add MoveActivity (account migration) to InboxActivities enum
- Add bto/bcc fields to CreateActivity for blind DM support
- http_signature_compat(true) restricted to debug mode only
- Announce of non-local object logs debug instead of silent drop
- postgres-federation: get_followers/get_following_page/count_following
now consistently filter by status='accepted'
