accumulated fixes and improvements from neodb

[alphatownsman]

Main fix is QuoteAuthorization which was incomplete in previous implementation.

ActivityPub compatibility

• accept list-form attributedTo (WriteFreely blog Articles)
• follow Link rel=alternate to resolve AP Article URLs
• only accept URL-shaped quote values, validate length and scheme
• give identity Update/Delete/Move activities unique IDs (deduplication)
• serve QuoteAuthorization at a dereferenceable URL (FEP-044f)
• treat image-only Notes as Posts instead of Interactions
• skip emoji tag ingestion when author has no domain
• accept Article posts without local Article row (Post-only renderer)
• coalesce list-typed poll option name to string (pl.fediverse.pl)
• handle vote-type in PostInteraction undo to prevent ValueError
• handle UnicodeDecodeError when parsing nodeinfo well-known response
• ignore Undo Block when block does not exist locally
• treat 410 Gone as final on POST delivery (no retry)
• validate URI scheme before fetching posts and replies
• return 400 for unparseable HTTP signatures
• return 404 for non-numeric IDs in API pk lookups
• use ActivityPubError subtypes for invalid inbound activities

Security

• add SSRF protection to all outbound HTTP requests (core.files)
• enforce CSRF verification for session-authenticated API requests
• harden OAuth token exchange against error leak and timing attack
• force safe Content-Type on media proxy responses
• use CodeQL-recognized sanitizers for url-redirection
• fix XXE in host-meta parsing and weak PRNG for tokens
• fix LD signature creator-actor binding
• fix inbox signature verification
• address several CodeQL code-scanning alerts

Performance

• avoid OR-subquery in notification queries, add partial index
• match bell-follows by target_id, not Follow id
• collapse Hashtag stator stats into 2 queries
• use timestamp ranges in Hashtag stat filters (avoid per-row casts)
• avoid slow OR query in quote post URL lookup

Robustness

• translate ClearTimeline deadlocks to TryAgainLater so Stator reschedules
• less noisy logging for DNS errors
• use utf-8 encoding for URL hashing in ProxyAbsoluteUrl