Add AP inbox endpoint + device auth signaling

- POST /inbox with HTTP Signature verification
- Device ID cookie tracking + adoption from account
- Silent auth checks local Redis for did_auth signals
- Replaces shared-Redis coupling with AP activity delivery

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

requirements.txt

@@ -3,6 +3,7 @@ redis>=5.0.0
 requests>=2.31.0
 httpx>=0.27.0
 itsdangerous>=2.0
+cryptography>=41.0
 fastapi>=0.109.0
 uvicorn>=0.27.0
 python-multipart>=0.0.6