fix: don't require a server-custodied rotation key

cache: DID, SSO, & OAuth client metadata caches onto shared cache

feat(docs): explain our definition of "correct PDS implementation"

scopes: tweak tests, add translations

feat(config): add more default crawlers/relays

totp: let legacy sessions disable totp

fix(api): dont verify signature or DID during importRepo

feat(test): test that websockets get closed

feat(tranquil-store): gc and hardening