docs(journal): federation privacy manifest + runbook + honest home blurb (§10)

10.1 Privacy manifest (legal/privacy):
- German legal half: Föderation entry under Empfänger/Drittanbieter —
  what a public profile exposes, what accepted followers' servers
  receive, the loss-of-control over delivered copies, Art. 6(1)(a)
  basis, private profiles don't federate.
- English manifest half: dedicated Federation (ActivityPub) section —
  actor object contents, push delivery + retraction semantics (incl.
  the tombstone caveat), encrypted-at-rest signing keys, remote actor
  cache, ingested remote content with the followers-only viewer gate,
  inbox logging/rate limits. PRIVACY_LAST_UPDATED bumped.

10.2 docs/deployment.md federation runbook: enabling per environment,
key rotation posture, abuse monitoring, and the troubleshooting
checklist distilled from the 2026-06-06/07 soak (IP families first,
no outbox backfill, tombstones, the 10s delivery timeout, actor
re-fetch).

10.3 Home marketing blurb (en+de) aligned to what actually ships:
Mastodon can follow you + trails-to-trails outbound — no more 'follow
friends anywhere' overstatement.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/journal/app/lib/legal.ts

@@ -16,4 +16,4 @@ export const TERMS_VERSION = "2026-04-19";
  * require re-acceptance (the policy is informational, not contract), so this
  * is display-only — not persisted.
  */
-export const PRIVACY_LAST_UPDATED = "2026-04-20";
+export const PRIVACY_LAST_UPDATED = "2026-06-07";

apps/journal/app/routes/legal.privacy.tsx

@@ -260,6 +260,22 @@ export default function PrivacyPage() {
             , der ohne Query-Logs arbeitet. Eine selbst gehostete Instanz ist
             geplant.
           </li>
+          <li>
+            <strong>Föderation (ActivityPub)</strong> – Wenn Ihr Profil auf{" "}
+            <code>public</code> steht, ist Ihr Konto über das
+            ActivityPub-Protokoll föderiert: Andere Server (z.&nbsp;B.
+            Mastodon-Instanzen oder andere trails.cool-Instanzen) können Ihr
+            öffentliches Profil (Anzeigename, Nutzername, Bio, öffentlicher
+            Signaturschlüssel) abrufen und Ihnen folgen. An die Server
+            angenommener Follower übermitteln wir Ihre als{" "}
+            <code>public</code> markierten Aktivitäten (Titel, Statistiken,
+            Link). Diese Server liegen außerhalb unserer Kontrolle; was dort
+            mit zugestellten Inhalten geschieht (Speicherung, Anzeige,
+            Weiterverbreitung), richtet sich nach deren Richtlinien.
+            Rechtsgrundlage ist Ihre Einwilligung durch das aktive
+            Veröffentlichen (Art. 6 Abs. 1 lit. a DSGVO). Private Profile
+            föderieren nicht.
+          </li>
           <li>
             <strong>BRouter</strong> – Routenberechnung läuft auf einer von uns
             selbst gehosteten Instanz. Keine Weitergabe an Dritte.
@@ -452,6 +468,53 @@ export default function PrivacyPage() {
         </ul>
       </section>
 
+      <section className="mt-8">
+        <h3 className="text-xl font-semibold text-gray-900">
+          Federation (ActivityPub)
+        </h3>
+        <p className="mt-2 text-gray-700">
+          Applies only when your profile visibility is <code>public</code>.
+          Private profiles do not federate at all — no actor object, no
+          WebFinger, no inbox.
+        </p>
+        <ul className="mt-3 list-disc pl-6 text-gray-700 space-y-1">
+          <li>
+            Your actor object (fetchable by any fediverse server) exposes:
+            username, display name, bio, profile link, and your public
+            signing key. Never your email, never private content.
+          </li>
+          <li>
+            Activities you mark <code>public</code> are pushed to the
+            servers of your accepted remote followers and listed in your
+            public outbox. Once delivered, copies live on those servers
+            under their policies — un-publishing sends a retraction, but
+            remote deletion cannot be guaranteed (and remote servers that
+            processed a retraction will not re-show a later re-publish).
+          </li>
+          <li>
+            Signing keys: one RSA keypair per user. The private key is
+            stored encrypted at rest and never leaves this server.
+          </li>
+          <li>
+            Remote actor cache: for accounts that interact with this
+            instance we store their public profile basics (handle, display
+            name, inbox/outbox URLs, public key) to render follower lists
+            and feeds without re-fetching.
+          </li>
+          <li>
+            Remote content: public (or followers-only) activities from
+            trails users you follow on other instances are cached here for
+            your feed — followers-only items are shown only to the
+            follower whose follow brought them in.
+          </li>
+          <li>
+            Inbox traffic (signed requests from other servers) appears in
+            the standard server logs (14-day retention, see section 4) and
+            is rate-limited per source instance.
+          </li>
+        </ul>
+      </section>
+
       <section className="mt-8">
         <h3 className="text-xl font-semibold text-gray-900">Sentry</h3>
         <ul className="mt-3 list-disc pl-6 text-gray-700 space-y-1">