R9 Web Push, then the honest version: VAPID key, push subscriptions, encrypted pushes, 4.5.0 advertised

The server's VAPID key (PushKeys, made on first need, in Mongo) is the instance API's vapid.public_key and every app's
vapid_key. /api/v1/push/subscription (POST, GET, PUT, DELETE) keeps one subscription per access token, so per persona;
every notification kept (never a filtered one) is queued as a SendPush job for the subscriptions whose alert and policy
admit it, and sent through the `push` client (the safe handler, https only) encrypted as RFC 8291 aes128gcm or the
aesgcm draft with an ES256 VAPID JWT. 404/410 delete the subscription, 429/5xx/timeouts retry, other answers drop the
push. Subscriptions end with their tokens (revocation, sessions ended, suspension, deletion, a restore); backups hold
neither keys nor subscriptions. The walk of every Mastodon 4.3-4.5 client route (docs/MASTODON-API.md) added
conversations/:id/unread, domain_blocks/preview, v2 notifications clear and PUT policy, /oauth/userinfo and stubs, so both
instance APIs now say 4.5.0 (compatible; PrivaPub <release>). The pasture gets a push sink (pushsink.test) and
scenarios/push.sh in batch A.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

PrivaPub/Api/Mastodon/Controllers/SearchController.cs

@@ -140,9 +140,6 @@ namespace PrivaPub.Api.Mastodon.Controllers
 
 	public class StubsController : MastodonController
 	{
-		[HttpGet("/api/v1/push/subscription"), Scope("push")]
-		public IActionResult PushSubscription() => Error(StatusCodes.Status404NotFound, "Record not found");
-
 		// Routes Mastodon answers that we have nothing behind: an empty or default answer lets clients degrade, where a
 		// 404 breaks some of them (Mastodon invariant 5)
 		[HttpGet("/api/v1/timelines/link"), Microsoft.AspNetCore.Authorization.AllowAnonymous]
@@ -163,9 +160,35 @@ namespace PrivaPub.Api.Mastodon.Controllers
 		[HttpPost("/api/v1/statuses/{id}/translate"), Scope("read:statuses")]
 		public IActionResult Translate(string id) => Error(StatusCodes.Status422UnprocessableEntity, "Translation is not available on this server");
 
-		// Mastodon 4.3's yearly reports (Wrapstodon): none are made here, so there are never any to show
-		[HttpGet("/api/v1/annual_reports"), Scope("read:accounts")]
-		public IActionResult AnnualReports() => Json(new { annual_reports = Array.Empty<object>(), accounts = Array.Empty<object>(), statuses = Array.Empty<object>() });
+		// Mastodon 4.3's yearly reports (Wrapstodon): none are made here, so there are never any to show, for any year (4.4's
+		// show), and marking one read changes nothing
+		[HttpGet("/api/v1/annual_reports"), HttpGet("/api/v1/annual_reports/{year}"), Scope("read:accounts")]
+		public IActionResult AnnualReports(string year) => Json(new { annual_reports = Array.Empty<object>(), accounts = Array.Empty<object>(), statuses = Array.Empty<object>() });
+
+		[HttpPost("/api/v1/annual_reports/{year}/read"), Scope("write:accounts")]
+		public IActionResult ReadAnnualReport(string year) => Json(new { });
+
+		// Registration through the API is cut (owner decision 2026-10-17): a login is made by setup or an invitation, on
+		// /clientapi. Mastodon answers this when its registrations are closed; its e-mail confirmation routes follow, since no
+		// account here waits for one
+		[HttpPost("/api/v1/accounts"), Microsoft.AspNetCore.Authorization.AllowAnonymous]
+		public IActionResult Register() => Error(StatusCodes.Status403Forbidden, "This action is not allowed");
+
+		[HttpPost("/api/v1/emails/confirmations"), Scope("write:accounts")]
+		public IActionResult ResendConfirmation() =>
+			Error(StatusCodes.Status403Forbidden, "This method is only available while the e-mail is awaiting confirmation");
+
+		[HttpGet("/api/v1/emails/check_confirmation"), Scope("read:accounts")]
+		public IActionResult CheckConfirmation() => Json(true);
+
+		// the peers' names are not published (/instance/peers stays empty), so a search of them finds none
+		[HttpGet("/api/v1/peers/search"), Microsoft.AspNetCore.Authorization.AllowAnonymous]
+		public IActionResult SearchPeers() => Json(Array.Empty<string>());
+
+		// Mastodon 4.4's asynchronous refreshes are announced by a Mastodon-Async-Refresh header, which PrivaPub never sends
+		// (a thread's replies are read again in the background and simply show up): there is never one to ask about
+		[HttpGet("/api/v1_alpha/async_refreshes/{id}"), Scope("read")]
+		public IActionResult AsyncRefresh(string id) => NotFoundError();
 
 		// the Mastodon admin API is cut: moderation stays on /clientapi (ModeratorController, AdminController), so every
 		// admin route answers as Mastodon answers an account that may not use it, whoever asks