net10, the refactor finished, and federation that works

The tree had not compiled since its first commit: Group, DmGroup and
IGroupUsersService were referenced and never written, an IDE rename had
turned the user-settings DTO into the ViewAvatarServer enum, and the settings
were saved as an entity they no longer were.

Built now:
- Group (an ActivityPub Group actor with its own keys, members, invitation
  code and optional password) and DmGroup (a conversation), with
  /clientapi/group/{list,insert,update,join,leave,approve}.
- Posts and DMs: /clientapi/post/{list,insert,delete}, /clientapi/dm/{list,insert};
  DM recipients are local usernames or user@host handles resolved by WebFinger.
- Invitation sign-up and login against the group's invitation code, checking
  the password before any account is created.
- Federation: WebFinger, NodeInfo 2.0, actors at /peasants/{name} (Person,
  Group, and an Application instance actor) with SPKI keys, draft-cavage
  RSA-SHA256 HTTP signatures both ways, an inbox handling Follow (+Accept),
  Undo, Create, Delete and Update, an outbox, notes at /posts/{id}, and a
  persisted, retried, signed delivery queue. A post to a group is announced
  by the group to its followers (FEP-1b12).
- The unused, broken typed ActivityPub models are replaced by a renderer;
  NSign's HMAC setup, which could not federate, is gone.

Upgrade: net10.0, MongoDB.Entities 25.1 (instance DB API, Standard GUIDs),
Swashbuckle 10 / OpenApi 2, Serilog.AspNetCore 10, MailKit 4.18,
PasswordGenerator 3. The JWT keys are 64 bytes (IdentityModel 8 refuses
shorter for HS512). Production runs its own mongod on 127.0.0.1:27022, as
Sintopia's apps do, and deploys to privapub.thepra.dev from the build runner.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB

deploy/max/setup.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+# One-time root setup on Max for PrivaPub at privapub.thepra.dev. Idempotent.
+#   rsync -a -e $MAX/ssh.sh deploy/ root@nuvola.xyz:/root/privapub-deploy/
+#   $MAX/run.sh bash /root/privapub-deploy/max/setup.sh
+set -euo pipefail
+SRC="${1:-/root/privapub-deploy}"
+HOST=privapub.thepra.dev
+UNIT=privapub
+RUNNER=build-runner
+ACME=/root/.acme.sh/acme.sh
+
+echo "== directories"
+install -d -o "$RUNNER" -g www-data -m 755 /var/www/$HOST
+install -d -o "$RUNNER" -g "$RUNNER" -m 750 /var/backups/$HOST
+install -d -o www-data -g www-data -m 750 /var/lib/privapub /var/lib/privapub/mongo
+
+echo "== sudoers"
+SUDOERS=/etc/sudoers.d/$RUNNER
+touch "$SUDOERS"; chmod 440 "$SUDOERS"
+grep -qF "systemctl start $UNIT," "$SUDOERS" || echo "$RUNNER ALL=(root) NOPASSWD: /usr/bin/systemctl start $UNIT, /usr/bin/systemctl stop $UNIT, /usr/bin/systemctl restart $UNIT, /usr/bin/systemctl is-active $UNIT, /usr/bin/systemctl show $UNIT*, /usr/bin/systemctl status $UNIT*" >> "$SUDOERS"
+visudo -cf "$SUDOERS"
+
+echo "== units"
+install -m 644 "$SRC/systemd/privapub-mongod.service" /etc/systemd/system/privapub-mongod.service
+install -m 644 "$SRC/systemd/$UNIT.service" /etc/systemd/system/$UNIT.service
+systemctl daemon-reload
+systemctl enable --now privapub-mongod >/dev/null
+systemctl enable $UNIT >/dev/null
+systemctl is-active privapub-mongod
+
+echo "== nginx snippet and bootstrap vhost"
+install -m 644 "$SRC/nginx/privapub-headers.conf" /etc/nginx/snippets/privapub-headers.conf
+if [ -f /root/.acme.sh/${HOST}_ecc/fullchain.cer ]; then
+	install -m 644 "$SRC/nginx/$HOST.conf" /etc/nginx/sites-available/$HOST.conf
+else
+	awk '/^server \{/{n++} n==1' "$SRC/nginx/$HOST.conf" > /etc/nginx/sites-available/$HOST.conf
+fi
+ln -sf /etc/nginx/sites-available/$HOST.conf /etc/nginx/sites-enabled/$HOST.conf
+nginx -t
+systemctl reload nginx
+
+echo "== certificate"
+if [ -f /root/.acme.sh/${HOST}_ecc/fullchain.cer ]; then
+	echo "$HOST: certificate present"
+else
+	$ACME --issue --server letsencrypt -d $HOST -w /var/www/acme --renew-hook "systemctl reload nginx"
+fi
+
+echo "== full vhost"
+install -m 644 "$SRC/nginx/$HOST.conf" /etc/nginx/sites-available/$HOST.conf
+nginx -t
+systemctl reload nginx
+echo "setup complete"

deploy/nginx/privapub-headers.conf

@@ -0,0 +1,4 @@
+add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+add_header X-Content-Type-Options "nosniff" always;
+add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+add_header X-Frame-Options "DENY" always;

deploy/nginx/privapub.thepra.dev.conf

@@ -0,0 +1,48 @@
+server {
+	listen 80;
+	listen [::]:80;
+	server_name privapub.thepra.dev;
+
+	location ^~ /.well-known/acme-challenge/ {
+		root /var/www/acme;
+		default_type "text/plain";
+	}
+
+	location / {
+		return 301 https://$host$request_uri;
+	}
+}
+
+server {
+	listen       443 ssl;
+	listen 8444 ssl proxy_protocol;
+	listen       [::]:443 ssl;
+	server_name  privapub.thepra.dev;
+	http2 on;
+
+	include /etc/nginx/ssl.conf;
+	ssl_certificate     /root/.acme.sh/privapub.thepra.dev_ecc/fullchain.cer;
+	ssl_certificate_key /root/.acme.sh/privapub.thepra.dev_ecc/privapub.thepra.dev.key;
+	include /etc/nginx/snippets/privapub-headers.conf;
+
+	access_log /var/log/nginx/privapub.thepra.dev.access.log;
+	error_log  /var/log/nginx/privapub.thepra.dev.error.log;
+
+	client_max_body_size 2m;
+
+	location ^~ /.well-known/acme-challenge/ {
+		root /var/www/acme;
+		default_type "text/plain";
+	}
+
+	location / {
+		proxy_pass         http://127.0.0.1:6970;
+		proxy_http_version 1.1;
+		proxy_set_header   Connection "";
+		proxy_set_header   Host $host;
+		proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header   X-Real-IP $remote_addr;
+		proxy_set_header   X-Forwarded-Proto $scheme;
+		proxy_read_timeout 60s;
+	}
+}

deploy/systemd/privapub-mongod.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=PrivaPub's own mongod (127.0.0.1:27022)
+After=network.target
+
+[Service]
+Type=exec
+User=www-data
+Group=www-data
+ExecStart=/usr/bin/mongod --dbpath /var/lib/privapub/mongo --port 27022 --bind_ip 127.0.0.1 --noauth --wiredTigerCacheSizeGB 0.25 --quiet
+Restart=always
+RestartSec=5
+LimitNOFILE=64000
+SyslogIdentifier=privapub-mongod
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/privapub.service

@@ -0,0 +1,20 @@
+[Unit]
+Description=PrivaPub ActivityPub server (privapub.thepra.dev)
+After=network-online.target privapub-mongod.service
+Wants=network-online.target
+Requires=privapub-mongod.service
+
+[Service]
+Type=exec
+User=www-data
+Group=www-data
+WorkingDirectory=/var/www/privapub.thepra.dev
+ExecStart=/var/www/privapub.thepra.dev/PrivaPub
+Environment=ASPNETCORE_ENVIRONMENT=Production
+Environment=DOTNET_CLI_TELEMETRY_OPTOUT=1
+Restart=always
+RestartSec=5
+SyslogIdentifier=privapub
+
+[Install]
+WantedBy=multi-user.target