fed-sx-m2: Step 10b — webfinger HTTP route + 10 tests

GET /.well-known/webfinger?resource=acct:user@host lands in
http_server.erl next to the existing /.well-known/sx-capabilities
arm.

Dispatch chain:
  route/2 -> dispatch/4 (matches webfinger path) -> handle_webfinger/1
  -> webfinger_for_query/2
  -> parse_resource_param/1 (matches "resource=" + collect via
                              take_until_amp/1)
  -> discovery:parse_acct/1
  -> webfinger_lookup/3 — host check + kernel actor lookup
     -> 200 + discovery:webfinger_body/3 (application/activity+json)
     -> 404 on any miss

Cfg surface:
  {webfinger_host, Binary}   optional; when set the acct's @host
                             must match exactly. Missing -> any.
  {kernel, Atom}             optional; when set, the user must be
                             a known actor in the registered kernel.
                             Missing -> every user is 'known' (pure
                             route tests).

route/2 already threads the Req's :query into Cfg as
:request_query (Step 4d), so the handler doesn't need to take
the Req directly.

10/10 in next/tests/webfinger_route.sh:
  - GET happy path (no kernel cfg'd) -> 200
  - body has subject prefix
  - body has href substring
  - missing ?resource= -> 404
  - garbage 'resource=garbage' -> 404
  - kernel cfg: alice 200, ghost 404
  - :webfinger_host matches @host -> 200
  - :webfinger_host mismatch -> 404
  - POST -> 404 (only GET handled)

discovery.sh 12/12 unchanged, http_route.sh 11/11 unchanged.

plans/fed-sx-milestone-2.md

@@ -672,10 +672,25 @@ Per §13.7: webfinger plus actor doc fetch.
   `<<"...">>` string-literal segments truncate to one byte on
   this port (briefing gotcha re-confirmed), so `"acct:"` is
   spelled as `<<97,99,99,116,58>>`. 12/12 in `discovery.sh`.
-- [ ] **10b** — http_server route for
-  `GET /.well-known/webfinger?resource=acct:...`: parses the
-  query, looks up the actor via the kernel, returns 200 +
-  webfinger_body when known, 404 otherwise.
+- [x] **10b** — http_server route
+  `GET /.well-known/webfinger?resource=acct:user@host`. New
+  dispatch arm next to `/.well-known/sx-capabilities` calls
+  `handle_webfinger/1(Cfg)`, which reads `:request_query` from
+  Cfg (threaded by route/2 from the Req's `:query` field per
+  Step 4d), parses the `resource=` param via
+  `parse_resource_param/1` + `take_until_amp/1`, hands off to
+  `discovery:parse_acct/1`, then to `webfinger_lookup/3`:
+  - Optional Cfg `:webfinger_host` (binary) — when set, the
+    acct's `@host` must match exactly; missing accepts any.
+  - Optional Cfg `:kernel` (atom, per Step 4c) — uses
+    `kernel_has_actor/2` to verify the actor exists. When no
+    kernel cfg'd (pure route tests), every user is "known".
+  - Match → 200 + `discovery:webfinger_body/3` rendered as
+    `application/activity+json`; miss → 404.
+  10/10 in `webfinger_route.sh` covering happy paths
+  (no-kernel, with-kernel, host-match), 404 paths
+  (missing-resource, bad-acct, unknown-actor, host-mismatch,
+  wrong-method).
 - [ ] **10c** — Peer-actor fetch + cache write. Gates on
   Blockers #2 (native `http-request` primitive missing).
   Step 5's peer_actors cache already exposes the
@@ -970,6 +985,19 @@ proceed.
 
 Newest first.
 
+- **2026-06-07** — Step 10b: webfinger HTTP route.
+  `GET /.well-known/webfinger?resource=acct:user@host` lands in
+  `http_server.erl` next to the existing
+  `/.well-known/sx-capabilities` arm. New `handle_webfinger/1`
+  reads `:request_query` from Cfg (threaded via route/2 since
+  Step 4d), parses `resource=` + the acct: URI via
+  `discovery:parse_acct/1`, optionally matches against Cfg's
+  `:webfinger_host`, checks actor existence via the kernel atom
+  (when cfg'd), and renders the body via
+  `discovery:webfinger_body/3`. 10/10 in `webfinger_route.sh`.
+  Conformance + adjacent tests (`http_route` 11/11, `discovery`
+  12/12) preserved.
+
 - **2026-06-07** — Step 10a: discovery primitives. New
   `next/kernel/discovery.erl` parses acct: URIs
   (prefix optional), synthesises `http://<host>/actors/<user>`,