Fix duplicate AP posts + stable object IDs

- Stable object ID per source (Post#123 always gets the same id)
  instead of deriving from activity UUID
- Dedup Update activities (Ghost fires duplicate webhooks)
- Use setdefault for object id in delivery handler

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

services/federation_publish.py

@@ -8,6 +8,7 @@ which creates the APActivity in the same DB transaction.  AP delivery
 from __future__ import annotations
 
 import logging
+import os
 
 from sqlalchemy.ext.asyncio import AsyncSession
 
@@ -48,14 +49,20 @@ async def try_publish(
     if existing:
         if activity_type == "Create" and existing.activity_type != "Delete":
             return  # already published (allow re-Create after Delete/unpublish)
+        if activity_type == "Update" and existing.activity_type == "Update":
+            return  # already updated (Ghost fires duplicate webhooks)
         if activity_type == "Delete" and existing.activity_type == "Delete":
             return  # already deleted
-    elif activity_type == "Delete":
-        return  # never published, nothing to delete
+    elif activity_type in ("Delete", "Update"):
+        return  # never published, nothing to delete/update
 
-    # Delete must reference the same object id Mastodon received in Create
-    if activity_type == "Delete" and existing:
-        object_data["id"] = existing.activity_id + "/object"
+    # Stable object ID: same source always gets the same object id so
+    # Mastodon treats Create/Update/Delete as the same post.
+    domain = os.getenv("AP_DOMAIN", "rose-ash.com")
+    object_data["id"] = (
+        f"https://{domain}/users/{actor.preferred_username}"
+        f"/objects/{source_type.lower()}/{source_id}"
+    )
 
     try:
         await services.federation.publish_activity(