Read-only ActivityPub → atproto bridge for the threadiverse using Coves lexicons

feat(admin): re-emit endpoint + did:web document — unblock AppView indexing of pre-crawl records master

Two gaps found wiring the Coves AppView to the production bridge: - /.well-known/did.json now serves the bridge's derived did:web identity. Coves' hostedBy verification resolves it bidirectionally (id + at:// alias) and fails closed when missing, so no bridged community could index without it. The resolver also gains the derived service DID (previously only a provisioned BRIDGE_SERVICE_DID resolved the bare hostname handle). - POST /admin/reemit re-emits a repo's records (or every active repo) onto the firehose as delete+create pairs with identical values: real MST diffs relays accept, unchanged at-uris and CIDs so strongRefs survive. Exists for the relay cold-start gap — records committed before a relay first subscribes never re-emit organically, leaving a Jetstream-fed AppView permanently blind to them. Profiles re-emit before posts before comments so indexers see identities first. Tombstoned repos are never touched. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>