fed-sx-m2: Step 10b — webfinger HTTP route + 10 tests

GET /.well-known/webfinger?resource=acct:user@host lands in
http_server.erl next to the existing /.well-known/sx-capabilities
arm.

Dispatch chain:
  route/2 -> dispatch/4 (matches webfinger path) -> handle_webfinger/1
  -> webfinger_for_query/2
  -> parse_resource_param/1 (matches "resource=" + collect via
                              take_until_amp/1)
  -> discovery:parse_acct/1
  -> webfinger_lookup/3 — host check + kernel actor lookup
     -> 200 + discovery:webfinger_body/3 (application/activity+json)
     -> 404 on any miss

Cfg surface:
  {webfinger_host, Binary}   optional; when set the acct's @host
                             must match exactly. Missing -> any.
  {kernel, Atom}             optional; when set, the user must be
                             a known actor in the registered kernel.
                             Missing -> every user is 'known' (pure
                             route tests).

route/2 already threads the Req's :query into Cfg as
:request_query (Step 4d), so the handler doesn't need to take
the Req directly.

10/10 in next/tests/webfinger_route.sh:
  - GET happy path (no kernel cfg'd) -> 200
  - body has subject prefix
  - body has href substring
  - missing ?resource= -> 404
  - garbage 'resource=garbage' -> 404
  - kernel cfg: alice 200, ghost 404
  - :webfinger_host matches @host -> 200
  - :webfinger_host mismatch -> 404
  - POST -> 404 (only GET handled)

discovery.sh 12/12 unchanged, http_route.sh 11/11 unchanged.

next/kernel/http_server.erl

@@ -132,6 +132,11 @@ dispatch(<<71, 69, 84>>,
          <<47,46,119,101,108,108,45,107,110,111,119,110,
            47,115,120,45,99,97,112,97,98,105,108,105,116,105,101,115>>, F, _Cfg) ->
     ok_response(capabilities_body_for(F));
+%% GET /.well-known/webfinger — Step 10b
+dispatch(<<71, 69, 84>>,
+         <<47,46,119,101,108,108,45,107,110,111,119,110,
+           47,119,101,98,102,105,110,103,101,114>>, _F, Cfg) ->
+    handle_webfinger(Cfg);
 %% GET /projections — list stub. Comes before the /projections/{name}
 %% prefix clause because the bare path has no trailing slash.
 dispatch(<<71, 69, 84>>, <<47,112,114,111,106,101,99,116,105,111,110,115>>, F, _Cfg) ->
@@ -1229,3 +1234,67 @@ resolve_via_srv(PeerId, Cfg) ->
 find_peer(_, []) -> not_found;
 find_peer(K, [{K, V} | _]) -> {ok, V};
 find_peer(K, [_ | Rest]) -> find_peer(K, Rest).
+
+%% ── Step 10b: GET /.well-known/webfinger ───────────────────────
+%%
+%% Query: `?resource=acct:user@host`
+%% Response: 200 with webfinger JSON when actor known + host matches;
+%%           404 otherwise.
+%%
+%% Cfg may carry:
+%%   {kernel, Atom}            registered kernel atom (per Step 4c)
+%%   {webfinger_host, Binary}  expected @host; missing = any
+%% Both optional — with no kernel, every actor is "known" so we
+%% still serve a valid body (callers without a kernel are running
+%% pure routing tests).
+
+handle_webfinger(Cfg) ->
+    case field(request_query, Cfg) of
+        nil -> not_found_response();
+        Q   -> webfinger_for_query(Q, Cfg)
+    end.
+
+webfinger_for_query(Query, Cfg) ->
+    case parse_resource_param(Query) of
+        {ok, AcctBin} ->
+            case discovery:parse_acct(AcctBin) of
+                {ok, User, Host} -> webfinger_lookup(User, Host, Cfg);
+                _                -> not_found_response()
+            end;
+        _ -> not_found_response()
+    end.
+
+%% "resource=" — 9 bytes
+parse_resource_param(Query) ->
+    Prefix = <<114,101,115,111,117,114,99,101,61>>,
+    case match_prefix(Prefix, Query) of
+        {ok, Rest} -> {ok, take_until_amp(Rest)};
+        _          -> error
+    end.
+
+%% take_until_amp/1 — collect bytes until the next "&" (38) or eob.
+%% URL-decoding (percent-escapes) defers to v3; v2 inputs from
+%% Mastodon-compatible clients are alphanumeric + .-_@: only.
+
+take_until_amp(Bin) -> take_until_amp(Bin, <<>>).
+take_until_amp(<<>>, Acc) -> Acc;
+take_until_amp(<<38, _/binary>>, Acc) -> Acc;
+take_until_amp(<<B, Rest/binary>>, Acc) -> take_until_amp(Rest, <<Acc/binary, B>>).
+
+webfinger_lookup(User, Host, Cfg) ->
+    case host_matches(Host, field(webfinger_host, Cfg)) of
+        false -> not_found_response();
+        true ->
+            case kernel_has_actor(field(kernel, Cfg), User) of
+                true ->
+                    Url  = discovery:actor_url_for(User, Host),
+                    Body = discovery:webfinger_body(User, Host, Url),
+                    ok_response(Body, json);
+                false ->
+                    not_found_response()
+            end
+    end.
+
+host_matches(_, nil) -> true;
+host_matches(H, H)   -> true;
+host_matches(_, _)   -> false.