fix: comprehensive security, performance, and architecture audit fixes

27 issues fixed from multi-dimensional code review (4 Critical, 6 High, 11 Medium, 6 Low):

Security (Critical):
- Escape HTML in OAuth authorization page to prevent XSS (C1)
- Add CSRF protection to OAuth authorize flow (C2)
- Replace bypassable regex sanitizer with sanitize-html library (C3)
- Enforce OAuth scopes on all Mastodon API routes (C4)

Security (Medium/Low):
- Fix SSRF via DNS resolution before private IP check (M1)
- Add rate limiting to API, auth, and app registration endpoints (M2)
- Validate redirect_uri on POST /oauth/authorize (M4)
- Fix custom emoji URL injection with scheme validation + escaping (M5)
- Remove data: scheme from allowed image sources (L6)
- Add access token expiry (1hr) and refresh token rotation (90d) (M3)
- Hash client secrets before storage (L3)

Architecture:
- Extract batch-broadcast.js — shared delivery logic (H1a)
- Extract init-indexes.js — MongoDB index creation (H1b)
- Extract syndicator.js — syndication logic (H1c)
- Create federation-actions.js facade for controllers (M6)
- index.js reduced from 1810 to ~1169 lines (35%)

Performance:
- Cache moderation data with 30s TTL + write invalidation (H6)
- Increase inbox queue throughput to 10 items/sec (H5)
- Make account enrichment non-blocking with fire-and-forget (H4)
- Remove ephemeral getReplies/getLikes/getShares from ingest (M11)
- Fix LRU caches to use true LRU eviction (L1)
- Fix N+1 backfill queries with batch $in lookup (L2)

UI/UX:
- Split 3441-line reader.css into 15 feature-scoped files (H2)
- Extract inline Alpine.js interaction component (H3)
- Reduce sidebar navigation from 7 to 3 items (M7)
- Add ARIA live regions for dynamic content updates (M8)
- Extract shared CW/non-CW content partial (M9)
- Document form handling pattern convention (M10)
- Add accessible labels to functional emoji icons (L4)
- Convert profile editor to Alpine.js (L5)

Audit: documentation-central/audits/2026-03-24-activitypub-code-review.md
Plan: documentation-central/plans/2026-03-24-activitypub-audit-fixes.md

lib/inbox-queue.js

@@ -17,21 +17,20 @@ import { routeToHandler } from "./inbox-handlers.js";
  */
 async function processNextItem(collections, ctx, handle) {
   const { ap_inbox_queue } = collections;
-  if (!ap_inbox_queue) return;
+  if (!ap_inbox_queue) return false;
 
   const item = await ap_inbox_queue.findOneAndUpdate(
     { status: "pending" },
     { $set: { status: "processing" } },
     { sort: { receivedAt: 1 }, returnDocument: "after" },
   );
-  if (!item) return;
+  if (!item) return false;
 
   try {
     await routeToHandler(item, collections, ctx, handle);
-    await ap_inbox_queue.updateOne(
-      { _id: item._id },
-      { $set: { status: "completed", processedAt: new Date().toISOString() } },
-    );
+    // Delete completed items immediately — prevents unbounded collection growth
+    // that caused the inbox processor to hang on restart (95K+ documents).
+    await ap_inbox_queue.deleteOne({ _id: item._id });
   } catch (error) {
     const attempts = (item.attempts || 0) + 1;
     await ap_inbox_queue.updateOne(
@@ -46,6 +45,8 @@ async function processNextItem(collections, ctx, handle) {
     );
     console.error(`[inbox-queue] Failed processing ${item.activityType} from ${item.actorUrl}: ${error.message}`);
   }
+
+  return true;
 }
 
 /**
@@ -75,6 +76,9 @@ export async function enqueueActivity(collections, { activityType, actorUrl, obj
   });
 }
 
+const BATCH_SIZE = 10;
+const POLL_INTERVAL_MS = 1_000;
+
 /**
  * Start the background inbox processor.
  * @param {object} collections - MongoDB collections
@@ -86,14 +90,16 @@ export function startInboxProcessor(collections, getCtx, handle) {
   const intervalId = setInterval(async () => {
     try {
       const ctx = getCtx();
-      if (ctx) {
-        await processNextItem(collections, ctx, handle);
+      if (!ctx) return;
+      for (let i = 0; i < BATCH_SIZE; i++) {
+        const hadWork = await processNextItem(collections, ctx, handle);
+        if (!hadWork) break; // Queue empty, stop early
       }
     } catch (error) {
       console.error("[inbox-queue] Processor error:", error.message);
     }
-  }, 3_000); // Every 3 seconds
+  }, POLL_INTERVAL_MS);
 
-  console.info("[ActivityPub] Inbox queue processor started (3s interval)");
+  console.info(`[ActivityPub] Inbox queue processor started (${POLL_INTERVAL_MS}ms interval, batch size ${BATCH_SIZE})`);
   return intervalId;
 }