fix: comprehensive security, performance, and architecture audit fixes

27 issues fixed from multi-dimensional code review (4 Critical, 6 High, 11 Medium, 6 Low):

Security (Critical):
- Escape HTML in OAuth authorization page to prevent XSS (C1)
- Add CSRF protection to OAuth authorize flow (C2)
- Replace bypassable regex sanitizer with sanitize-html library (C3)
- Enforce OAuth scopes on all Mastodon API routes (C4)

Security (Medium/Low):
- Fix SSRF via DNS resolution before private IP check (M1)
- Add rate limiting to API, auth, and app registration endpoints (M2)
- Validate redirect_uri on POST /oauth/authorize (M4)
- Fix custom emoji URL injection with scheme validation + escaping (M5)
- Remove data: scheme from allowed image sources (L6)
- Add access token expiry (1hr) and refresh token rotation (90d) (M3)
- Hash client secrets before storage (L3)

Architecture:
- Extract batch-broadcast.js — shared delivery logic (H1a)
- Extract init-indexes.js — MongoDB index creation (H1b)
- Extract syndicator.js — syndication logic (H1c)
- Create federation-actions.js facade for controllers (M6)
- index.js reduced from 1810 to ~1169 lines (35%)

Performance:
- Cache moderation data with 30s TTL + write invalidation (H6)
- Increase inbox queue throughput to 10 items/sec (H5)
- Make account enrichment non-blocking with fire-and-forget (H4)
- Remove ephemeral getReplies/getLikes/getShares from ingest (M11)
- Fix LRU caches to use true LRU eviction (L1)
- Fix N+1 backfill queries with batch $in lookup (L2)

UI/UX:
- Split 3441-line reader.css into 15 feature-scoped files (H2)
- Extract inline Alpine.js interaction component (H3)
- Reduce sidebar navigation from 7 to 3 items (M7)
- Add ARIA live regions for dynamic content updates (M8)
- Extract shared CW/non-CW content partial (M9)
- Document form handling pattern convention (M10)
- Add accessible labels to functional emoji icons (L4)
- Convert profile editor to Alpine.js (L5)

Audit: documentation-central/audits/2026-03-24-activitypub-code-review.md
Plan: documentation-central/plans/2026-03-24-activitypub-audit-fixes.md

lib/controllers/interactions-boost.js

@@ -5,6 +5,7 @@
 
 import { validateToken } from "../csrf.js";
 import { resolveAuthor } from "../resolve-author.js";
+import { createContext, getHandle, getPublicationUrl, isFederationReady } from "../federation-actions.js";
 
 /**
  * POST /admin/reader/boost — send an Announce activity to followers.
@@ -28,7 +29,7 @@ export function boostController(mountPath, plugin) {
         });
       }
 
-      if (!plugin._federation) {
+      if (!isFederationReady(plugin)) {
         return response.status(503).json({
           success: false,
           error: "Federation not initialized",
@@ -36,14 +37,11 @@ export function boostController(mountPath, plugin) {
       }
 
       const { Announce } = await import("@fedify/fedify/vocab");
-      const handle = plugin.options.actor.handle;
-      const ctx = plugin._federation.createContext(
-        new URL(plugin._publicationUrl),
-        { handle, publicationUrl: plugin._publicationUrl },
-      );
+      const handle = getHandle(plugin);
+      const ctx = createContext(plugin);
 
       const uuid = crypto.randomUUID();
-      const baseUrl = plugin._publicationUrl.replace(/\/$/, "");
+      const baseUrl = getPublicationUrl(plugin).replace(/\/$/, "");
       const activityId = `${baseUrl}/activitypub/boosts/${uuid}`;
 
       const publicAddress = new URL(
@@ -160,7 +158,7 @@ export function unboostController(mountPath, plugin) {
         });
       }
 
-      if (!plugin._federation) {
+      if (!isFederationReady(plugin)) {
         return response.status(503).json({
           success: false,
           error: "Federation not initialized",
@@ -182,11 +180,8 @@ export function unboostController(mountPath, plugin) {
       }
 
       const { Announce, Undo } = await import("@fedify/fedify/vocab");
-      const handle = plugin.options.actor.handle;
-      const ctx = plugin._federation.createContext(
-        new URL(plugin._publicationUrl),
-        { handle, publicationUrl: plugin._publicationUrl },
-      );
+      const handle = getHandle(plugin);
+      const ctx = createContext(plugin);
 
       // Construct Undo(Announce)
       const announce = new Announce({