fed-sx-m2: Step 6b — wire follower_graph fold to inbox handler

http_server.erl run_inbox_pipeline now calls
broadcast_to_inbox_projections/2 after a successful
nx_kernel:append_inbox. Cfg may carry {inbox_projections,
[Name, ...]} listing projection gen_servers that should see every
successfully-ingested inbound activity. Each gets the activity via
projection:async_fold/2 — fire-and-forget so the inbox handler
doesn't block on fold processing. Empty / absent
:inbox_projections is a no-op (back-compat with Step 5d callers).

v2 leaves the routing field global (every inbound activity goes
to every named projection); per-actor projection wiring is a
forward-looking follow-up.

9/9 in next/tests/follow_lifecycle.sh:
  - Follow ingestion -> 202
  - follower_graph state: alice.pending_inbound = [bob]
  - follower_graph state: bob.pending_outbound = [alice]
  - inbox tip advances to 1 (Step 5a invariant preserved)
  - no inbox_projections Cfg -> projection state stays empty
  - end-to-end: Follow + Accept fold converges to
    alice.followers = [bob] and bob.following = [alice]
    (Accept fed via projection:async_fold for v2 — auto-Accept
    publish is Step 6c)
  - bad-sig inbound short-circuits before broadcast
  - two distinct peer Follows accumulate

bootstrap_start.sh internal sx_server timeout bumped 300s -> 600s
to match the cumulative cost trend other tests are seeing on this
port. (bootstrap_start doesn't load http_server but loads bootstrap
+ the full genesis bundle + 9 kernel modules — same cumulative
compile budget.)

Conformance 761/761.

plans/fed-sx-milestone-2.md

@@ -436,11 +436,27 @@ tracks the state. `Undo{Follow}` reverses it.
   18 cases in `follower_graph.sh`. The `fold_fn/0` 2-arity fun
   plugs into `projection:start_link/3` exactly like
   `define_registry:fold_fn/0` and `actor_state:fold_fn/0`.
-- [ ] **6b** — Wire follower-graph fold to the inbox handler so a
-  peer Follow lands, fires auto-Accept publish (open-world policy
-  per §13.2; manual moderation deferred to v3). Acceptance test
-  in `follow_lifecycle.sh` covering the end-to-end
-  Follow → inbox → auto-Accept → projection-state-converges flow.
+- [x] **6b** — Wire follower-graph fold to the inbox handler.
+  `http_server.erl` `run_inbox_pipeline` now calls
+  `broadcast_to_inbox_projections/2` after a successful
+  `nx_kernel:append_inbox`. Cfg may carry `{inbox_projections,
+  [Name, ...]}` listing projection gen_servers; each gets the
+  activity via `projection:async_fold/2` (fire-and-forget so the
+  handler doesn't block on fold processing). Field absent =
+  no-op. v2 leaves the routing field global; per-actor
+  projection wiring is a forward-looking follow-up. 9/9 in
+  `follow_lifecycle.sh` covering 202 ingestion, follower_graph
+  pending-state mutation on both sides, no-inbox_projections
+  no-op path, bad-sig short-circuit (projection stays clean),
+  multi-peer accumulation, end-to-end Follow+Accept projection
+  convergence (Accept fed in via projection:async_fold for v2).
+- [ ] **6c** — Auto-Accept publish. On Follow ingestion, the
+  receiving kernel constructs an `Accept{actor: target, object:
+  Follow}` envelope, signs it with the target's key, and
+  publishes via `nx_kernel:publish_to/2`. Per design §13.2 the
+  policy is open-world (auto-accept every Follow); manual
+  moderation (held in a pending list, accepted via /admin/) is
+  v3.
 
 **Acceptance:** `bash next/tests/follow_lifecycle.sh` passes 14+ cases.
 
@@ -813,6 +829,19 @@ proceed.
 
 Newest first.
 
+- **2026-06-06** — Step 6b: wire follower_graph fold to the
+  inbox handler. New `broadcast_to_inbox_projections/2` in
+  `http_server.erl` casts every successfully-ingested activity
+  into each `:inbox_projections` Cfg entry via
+  `projection:async_fold/2`. Fire-and-forget so the inbox
+  handler doesn't block on fold processing. Empty / absent
+  `:inbox_projections` is a no-op (back-compat with Steps 5d
+  callers). 9/9 in `follow_lifecycle.sh` covering 202 + bilateral
+  pending-state mutation + bad-sig short-circuit + multi-peer
+  + end-to-end projection convergence on Follow+Accept. Conformance
+  761/761. Auto-Accept publish (the receiving kernel responds
+  with a signed Accept) is Step 6c.
+
 - **2026-06-06** — Step 6a: follower-graph projection
   (`follower_graph.erl`). Pure-functional fold over Follow /
   Accept / Reject / Undo activities per design §13.2. State is a