Update app READMEs for monorepo

Remove stale submodule references, port numbers, and Running sections.
Add fragment composition details. Create READMEs for federation and account.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

federation/README.md

@@ -0,0 +1,44 @@
+# Federation App
+
+OAuth2 authorization server and ActivityPub social hub for the Rose Ash cooperative. Handles user authentication, fediverse federation, and social features (timeline, compose, follow, notifications).
+
+## Structure
+
+```
+app.py                  # Application factory (create_base_app + blueprints)
+path_setup.py           # Adds project root + app dir to sys.path
+entrypoint.sh           # Container entrypoint (optional migrations, Redis flush, start)
+bp/
+  auth/                 #   Login, magic link, logout, OAuth2 authorize endpoint
+  identity/             #   Actor profile management
+  social/               #   Timeline, compose, search, follow/unfollow,
+                        #   like/boost, notifications, following/followers lists
+  fragments/            #   Fragment endpoints
+models/                 # Re-export stubs pointing to shared/models/
+services/               # register_domain_services() — wires all domains
+templates/              # Federation-specific templates (override shared/)
+```
+
+## OAuth2 SSO
+
+Federation is the authorization server for all Rose Ash apps:
+
+- `/oauth/authorize` — authorization endpoint (PKCE supported)
+- Magic link login (passwordless email)
+- All client apps auto-get `/auth/login`, `/auth/callback`, `/auth/logout` via `shared/infrastructure/oauth.py`
+- Per-app first-party session cookies (Safari ITP compatible)
+
+## ActivityPub
+
+- Per-app actors: each app has its own AP actor (virtual projection of the same keypair)
+- Actor endpoints: webfinger, actor profile, inbox, outbox, followers
+- Social features: timeline, compose, search, follow/unfollow, like/boost, notifications
+- Activities emitted to `ap_activities` table, processed by `EventProcessor`
+- HTTP signatures + IPFS content addressing
+
+## Cross-domain communication
+
+- `services.blog.*` — post queries for content federation
+- `services.calendar.*` — event queries
+- `services.market.*` — product queries
+- `services.cart.*` — cart summary for context processor