feat(journal): Fedify spike — WebFinger + actor objects behind FEDERATION_ENABLED

social-federation tasks 1.1–1.3:

- Add @fedify/fedify pinned to exactly 2.1.16: every 2.2.x release
  depends on @fedify/webfinger@2.2.x which was never published to npm,
  so 2.1.16 is the newest installable version.
- app/lib/federation.server.ts: Federation instance with an actor
  dispatcher serving Person objects for public users; private and
  unknown users 404 (no existence leak). MemoryKvStore for now.
- /.well-known/webfinger resource route delegating to federation.fetch.
- ActivityPub content negotiation on /users/:username via route
  middleware (future.v8_middleware — no loader uses the context arg,
  so the flag is a no-op for existing code).
- FEDERATION_ENABLED env flag (default off) gating every federation
  surface.
- Unit tests exercise the Fedify dispatcher as a remote AP client:
  WebFinger resolution, actor fetch with Mastodon's Accept header,
  private-user 404s, flag-off 404s.

Spike verdict: Fedify fits — URL dispatch, JRD/AP serialization, and
visibility gating all work through framework routes without a custom
server layer.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/journal/package.json

@@ -12,18 +12,19 @@
     "test": "vitest run"
   },
   "dependencies": {
+    "@fedify/fedify": "2.1.16",
     "@react-router/node": "catalog:",
     "@react-router/serve": "catalog:",
     "@sentry/node": "catalog:",
     "@sentry/react": "catalog:",
     "@simplewebauthn/browser": "^13.3.0",
-    "@simplewebauthn/server": "^13.3.1",
+    "@simplewebauthn/server": "^13.3.0",
     "@trails-cool/api": "workspace:*",
     "@trails-cool/db": "workspace:*",
-    "@trails-cool/jobs": "workspace:*",
     "@trails-cool/fit": "workspace:*",
     "@trails-cool/gpx": "workspace:*",
     "@trails-cool/i18n": "workspace:*",
+    "@trails-cool/jobs": "workspace:*",
     "@trails-cool/map": "workspace:*",
     "@trails-cool/sentry-config": "workspace:*",
     "@trails-cool/types": "workspace:*",
@@ -31,7 +32,7 @@
     "drizzle-orm": "catalog:",
     "isbot": "^5.1.40",
     "jose": "^6.2.3",
-    "nodemailer": "^8.0.10",
+    "nodemailer": "^8.0.8",
     "pino": "^10.3.1",
     "prom-client": "^15.1.3",
     "react": "catalog:",