Addresses PR review feedback with security, validation, and reliability improvements. ## Security & Validation Improvements - Add lexicon-compliant error types (InvalidHandle, WeakPassword, etc.) - Implement official atProto handle validation per spec - Normalizes to lowercase before validation - Validates TLD restrictions (.local, .onion, etc. disallowed) - Max 253 char length enforcement - Reference: https://atproto.com/specs/handle - Add password validation (min 8 chars) - Protects PDS from spam by malicious third-party clients - PDS remains authoritative on final acceptance - Add HTTP client timeout (10s) to prevent hanging on slow PDS - Map service errors to proper XRPC error responses with correct status codes ## Test Reliability Improvements - Replace fixed time.Sleep() with retry-with-timeout pattern - Inline retry loops with 500ms polling intervals - Configurable deadlines per test scenario (10-15s) - 2x faster test execution on fast systems - More reliable on slow CI environments - Add E2E test database setup helper - Fix test expectations to match new error messages ## Architecture Documentation - Add TODO comments for future improvements: - Race condition in Jetstream consumer (sync.Once needed) - DID→PDS URL resolution via PLC directory for federation - Document that current implementation works for local dev - Mark federation support as future enhancement ## Files Changed New files: - internal/core/users/errors.go - Domain error types - tests/e2e/user_signup_test.go - Full E2E test coverage - internal/atproto/lexicon/social/coves/actor/signup.json - Lexicon spec - docs/E2E_TESTING.md - E2E testing guide - internal/jetstream/user_consumer.go - Event consumer - tests/integration/jetstream_consumer_test.go - Consumer tests - tests/integration/user_test.go - User service tests Modified: - internal/core/users/service.go - Enhanced validation + HTTP timeout - internal/api/routes/user.go - Lexicon error mapping - tests/integration/user_test.go - Updated test expectations ## Test Results ✅ All unit/integration tests pass ✅ Full E2E test suite passes (10.3s) ✅ Validates complete signup flow: XRPC → PDS → Jetstream → AppView → PostgreSQL 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>