fed-sx-m2: Step 4b — token -> ActorId map + 8 new tests

POST /activity now routes through nx_kernel:publish_to/2 when the
bearer token resolves to an explicit ActorId via Cfg's :tokens
proplist:

  Cfg = [{tokens, [{<<"alice-token">>, alice},
                   {<<"bob-token">>,   bob}]}]

resolve_token/2 returns {ok, ActorId} on a :tokens hit. On a miss
it falls back to the M1 :publish_token single-token field — match
returns {ok, legacy}, routing through nx_kernel:publish/1 (which
fans out to bucket 0) so every M1 test continues to pass.

handle_post_activity threads the resolved ActorRef to
publish_if_kernel/3 which dispatches publish_to/2 for explicit
actor ids and publish/1 for the legacy atom. The no-kernel
auth-only path (which preserves the post_activity_response_for stub
for unit-style tests of http_server alone) is unchanged.

Dead expected_token/1 helper removed (was only called by the old
check_bearer arm that resolve_token replaces).

8 new cases in next/tests/http_multi_actor.sh (25/25 total):
  - two-actor Cfg, Alice token -> 200 with cid:
  - Alice token publishes to alice (log_tip alice=1, bob=0)
  - Bob token publishes to bob (log_tip alice=0, bob=1)
  - interleaved Alice + Bob + Alice -> {2, 1}
  - unknown token + no :publish_token -> 401
  - legacy :publish_token still works (M1 back-compat)
  - tokens map AND legacy :publish_token coexist (each resolves to
    its own actor; legacy lands on alice bucket via publish/1)
  - no kernel + valid :tokens entry -> auth-only stub 200

Conformance 761/761. 116/116 across 10 Step-4-adjacent suites
(http_multi_actor, http_route, http_publish, http_post_format,
http_marshal, http_publish_fold, http_listen_bif, http_server_start,
nx_kernel_multi, bootstrap_start, actor_lifecycle).

plans/fed-sx-milestone-2.md

@@ -272,12 +272,19 @@ token; the token now maps to an `:actor_id` rather than a fixed `alice`.
   `accepted_response/1`). Unknown sub-paths under `/actors/<id>/`
   return 404. Bare `/actors/<id>` keeps the M1 `actor_doc_response_for`
   arm. 17 cases in `http_multi_actor.sh`.
-- [ ] **4b** — Token → ActorId map. Cfg's `:publish_token` becomes
-  `:tokens` (proplist `[{Token, ActorId}, ...]`). POST /activity
-  resolves the bearer token to an actor id and routes through
-  `nx_kernel:publish_to/2` instead of `publish/1`. Multi-token
-  Cfg keeps the M1 `:publish_token` single-token field as a
-  back-compat alias for one token mapping to `alice`.
+- [x] **4b** — Token → ActorId map. New `resolve_token/2` reads
+  `:tokens` from Cfg (proplist `[{Token, ActorId}, ...]`) and
+  returns `{ok, ActorId}` on match. Falls back to the M1
+  `:publish_token` single-token field on miss (returns
+  `{ok, legacy}`, route through `nx_kernel:publish/1` to bucket 0
+  unchanged). Cfg with both fields: `:tokens` wins for matched
+  tokens; `:publish_token` only consulted on `:tokens` miss.
+  `handle_post_activity` now threads the resolved `ActorRef` to
+  `publish_if_kernel/3` which dispatches `publish_to/2` for
+  explicit actor ids and `publish/1` for the `legacy` atom.
+  No-kernel auth-only path unchanged. The dead M1
+  `expected_token/1` helper is gone. 8 new cases in
+  `http_multi_actor.sh` (25/25 total).
 - [ ] **4c** — `http_server:route/3(Req, Cfg, Kernel)` — the Cfg
   carries opaque `:kernel` reference (or accepts the registered
   `nx_kernel` atom) so per-actor handlers can call
@@ -731,6 +738,21 @@ proceed.
 
 Newest first.
 
+- **2026-06-06** — Step 4b: token -> ActorId map. Cfg's `:tokens`
+  proplist (`[{Token, ActorId}, ...]`) maps bearer tokens to
+  per-actor publishers. `handle_post_activity` threads the
+  resolved `ActorRef` to `publish_if_kernel/3` which calls
+  `nx_kernel:publish_to/2` for explicit actor ids and `publish/1`
+  for the back-compat `legacy` atom (M1's `:publish_token`
+  single-token field still works as-is). When both fields are
+  present, `:tokens` takes precedence; `:publish_token` is the
+  fallback on miss. Dead `expected_token/1` helper removed. 8
+  new cases in `http_multi_actor.sh` (25/25 total) covering
+  two-actor token routing, log-tip isolation, interleaved
+  publishes, bad-token 401, back-compat coexistence, no-kernel
+  stub path. Conformance 761/761 preserved. 116/116 across 10
+  Step-4-adjacent suites.
+
 - **2026-06-06** — Step 4a: per-actor HTTP sub-paths. New
   `split_first_slash/1` helper lets GET / POST `/actors/<id>/...`
   paths route on the sub-segment (`outbox`, `inbox`, `followers`,