Fixes from the deploy/auth and command-line parity audits: - no total timeout on PDS requests, so large blob uploads aren't cut off - app-password deploys never touch the account store (works without HOME) - resolve handles via slingshot + plc.directory and validate PDS endpoints like the TS CLI - generate the MIME table from the mime-types package the TS CLI used - Mozilla roots fallback for containers without a CA bundle; honour NODE_EXTRA_CA_CERTS - clean up subfs records left by a base64 retry; match chunk-size accounting - last repeated flag wins, bare --version, usage errors exit 1, `Error:` lines, ordered --json - fail fast with a hint when only a 1.x OAuth session exists