Add federation/ActivityPub models, contracts, and services

Phase 0+1 of ActivityPub integration:
- 6 ORM models (ActorProfile, APActivity, APFollower, APInboxItem, APAnchor, IPFSPin)
- FederationService protocol + SqlFederationService implementation + stub
- 4 DTOs (ActorProfileDTO, APActivityDTO, APFollowerDTO, APAnchorDTO)
- Registry slot for federation service
- Alembic migration for federation tables
- IPFS async client (httpx-based)
- HTTP Signatures (RSA-2048 sign/verify)
- login_url() now uses AUTH_APP env var for flexible auth routing

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

contracts/dtos.py

@@ -134,3 +134,56 @@ class CartSummaryDTO:
     items: list[CartItemDTO] = field(default_factory=list)
     ticket_count: int = 0
     ticket_total: Decimal = Decimal("0")
+
+
+# ---------------------------------------------------------------------------
+# Federation / ActivityPub domain
+# ---------------------------------------------------------------------------
+
+@dataclass(frozen=True, slots=True)
+class ActorProfileDTO:
+    id: int
+    user_id: int
+    preferred_username: str
+    public_key_pem: str
+    display_name: str | None = None
+    summary: str | None = None
+    inbox_url: str | None = None
+    outbox_url: str | None = None
+    created_at: datetime | None = None
+
+
+@dataclass(frozen=True, slots=True)
+class APActivityDTO:
+    id: int
+    activity_id: str
+    activity_type: str
+    actor_profile_id: int
+    object_type: str | None = None
+    object_data: dict | None = None
+    published: datetime | None = None
+    is_local: bool = True
+    source_type: str | None = None
+    source_id: int | None = None
+    ipfs_cid: str | None = None
+
+
+@dataclass(frozen=True, slots=True)
+class APFollowerDTO:
+    id: int
+    actor_profile_id: int
+    follower_acct: str
+    follower_inbox: str
+    follower_actor_url: str
+    created_at: datetime | None = None
+
+
+@dataclass(frozen=True, slots=True)
+class APAnchorDTO:
+    id: int
+    merkle_root: str
+    activity_count: int = 0
+    tree_ipfs_cid: str | None = None
+    ots_proof_cid: str | None = None
+    confirmed_at: datetime | None = None
+    bitcoin_txid: str | None = None