mastodon: Phanpy-grade local parity — timelines, threads, media, notifications

Timelines with real Link-header pagination, context threads over
inReplyTo, favourite/boost state, multipart media upload streaming into
the pod, notifications mapped from the AP inbox (Follow/Like/Announce/
mention), account endpoints, PKCE + refresh + revoke, and ~25 exact-
shape stubs so a strict client never errors. CORS on every response
including 4xx. /api widened to PUT+DELETE with catch-all JSON 404s so
the exemption can't fall through to LDP (test-proven).

New generalizable finding: base64url-of-URL ids exceed find-my-way's
maxParamLength (100) and :id routes silently stop matching — wildcard
dispatchers are the workaround; a plugin still can't set server opts.
27/27 tests (was 11).

Author: melvincarvalho