R9 Web Push, then the honest version: VAPID key, push subscriptions, encrypted pushes, 4.5.0 advertised

The server's VAPID key (PushKeys, made on first need, in Mongo) is the instance API's vapid.public_key and every app's
vapid_key. /api/v1/push/subscription (POST, GET, PUT, DELETE) keeps one subscription per access token, so per persona;
every notification kept (never a filtered one) is queued as a SendPush job for the subscriptions whose alert and policy
admit it, and sent through the `push` client (the safe handler, https only) encrypted as RFC 8291 aes128gcm or the
aesgcm draft with an ES256 VAPID JWT. 404/410 delete the subscription, 429/5xx/timeouts retry, other answers drop the
push. Subscriptions end with their tokens (revocation, sessions ended, suspension, deletion, a restore); backups hold
neither keys nor subscriptions. The walk of every Mastodon 4.3-4.5 client route (docs/MASTODON-API.md) added
conversations/:id/unread, domain_blocks/preview, v2 notifications clear and PUT policy, /oauth/userinfo and stubs, so both
instance APIs now say 4.5.0 (compatible; PrivaPub <release>). The pasture gets a push sink (pushsink.test) and
scenarios/push.sh in batch A.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

PrivaPub/Api/Mastodon/Controllers/UserinfoController.cs

@@ -0,0 +1,40 @@
+using Microsoft.AspNetCore.Mvc;
+
+using PrivaPub.Api.Mastodon.Infrastructure;
+using PrivaPub.Api.Mastodon.Mappers;
+using PrivaPub.Federation.Actors;
+
+namespace PrivaPub.Api.Mastodon.Controllers
+{
+	// Mastodon 4.4's OAuth userinfo (OpenID Connect's shape, GET or POST, the `profile` scope): who the token's persona is,
+	// for a site that signs in with it. Only what its public account says already; never its login. The authorization
+	// server's metadata names it (OAuthSetup).
+	public class UserinfoController : MastodonController
+	{
+		public const string Path = "/oauth/userinfo";
+
+		readonly MastodonMapper _mapper;
+		readonly ILocalActorService _localActors;
+
+		public UserinfoController(MastodonMapper mapper, ILocalActorService localActors)
+		{
+			_mapper = mapper;
+			_localActors = localActors;
+		}
+
+		[HttpGet(Path), HttpPost(Path), Scope("profile")]
+		public async Task<IActionResult> Show(CancellationToken token)
+		{
+			var account = await _mapper.Local(Me, false, token);
+			return Json(new
+			{
+				iss = _localActors.BaseAddress + "/",
+				sub = Me.Uri,
+				name = account.DisplayName,
+				preferred_username = account.Username,
+				profile = account.Url,
+				picture = account.Avatar
+			});
+		}
+	}
+}