Add federation/ActivityPub models, contracts, and services

Phase 0+1 of ActivityPub integration:
- 6 ORM models (ActorProfile, APActivity, APFollower, APInboxItem, APAnchor, IPFSPin)
- FederationService protocol + SqlFederationService implementation + stub
- 4 DTOs (ActorProfileDTO, APActivityDTO, APFollowerDTO, APAnchorDTO)
- Registry slot for federation service
- Alembic migration for federation tables
- IPFS async client (httpx-based)
- HTTP Signatures (RSA-2048 sign/verify)
- login_url() now uses AUTH_APP env var for flexible auth routing

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

services/stubs.py

@@ -18,6 +18,9 @@ from shared.contracts.dtos import (
     ProductDTO,
     CartItemDTO,
     CartSummaryDTO,
+    ActorProfileDTO,
+    APActivityDTO,
+    APFollowerDTO,
 )
 
 
@@ -182,3 +185,47 @@ class StubCartService:
         self, session: AsyncSession, user_id: int, session_id: str,
     ) -> None:
         pass
+
+
+class StubFederationService:
+    """No-op federation stub for apps that don't own federation."""
+
+    async def get_actor_by_username(self, session, username):
+        return None
+
+    async def get_actor_by_user_id(self, session, user_id):
+        return None
+
+    async def create_actor(self, session, user_id, preferred_username,
+                           display_name=None, summary=None):
+        raise RuntimeError("FederationService not available")
+
+    async def username_available(self, session, username):
+        return False
+
+    async def publish_activity(self, session, *, actor_user_id, activity_type,
+                               object_type, object_data, source_type=None,
+                               source_id=None):
+        return None
+
+    async def get_activity(self, session, activity_id):
+        return None
+
+    async def get_outbox(self, session, username, page=1, per_page=20):
+        return [], 0
+
+    async def get_activity_for_source(self, session, source_type, source_id):
+        return None
+
+    async def get_followers(self, session, username):
+        return []
+
+    async def add_follower(self, session, username, follower_acct, follower_inbox,
+                           follower_actor_url, follower_public_key=None):
+        raise RuntimeError("FederationService not available")
+
+    async def remove_follower(self, session, username, follower_acct):
+        return False
+
+    async def get_stats(self, session):
+        return {"actors": 0, "activities": 0, "followers": 0}