PieFed joins the pasture; the instance actor answers at the root

PieFed 1.7.17 (dockurr's image of the release) runs in the pasture with its
Celery worker on the shared Postgres and Redis, and scenarios/piefed.sh
checks it both ways: 29 checks, communities, titled threads, comments, votes
up and down, a community poll and a vote in it, private messages, a
moderator's lock, unlock and removal, the unfollow and statistics.

What it showed:
- PieFed sends a community's announces to the inbox of the Application at a
  peer's root (as Lemmy serves its site actor) and to /inbox otherwise.
  PrivaPub answered 404 at its root, so every announce went to an /inbox it
  does not have. The instance actor now answers at / for ActivityPub
  requests, unsigned under SecureMode as at its own address.
- PieFed keeps serving a thread its moderator removed, so the removal could
  never be checked against the post's origin. A community on the post's own
  server now speaks for it; one elsewhere still waits for the origin to say
  the post is gone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

PrivaPub.Tests/Http/FederationGetTests.cs

@@ -101,6 +101,20 @@ namespace PrivaPub.Tests.Http
 			Assert.Equal("Application", instance.Json["type"]!.GetValue<string>());
 		}
 
+		// PieFed reads the inbox it sends a community's announces to from the Application at a peer's root
+		[Fact]
+		public async Task The_instance_actor_answers_at_the_root_for_activitypub_only()
+		{
+			var root = await _client.Fetch("/");
+			var browser = await _client.Fetch("/", Browser);
+
+			Assert.Equal(HttpStatusCode.OK, root.Status);
+			Assert.Equal("Application", root.Json["type"]!.GetValue<string>());
+			Assert.Equal($"{Base}/peasants/privapub", root.Json["id"]!.GetValue<string>());
+			Assert.Equal($"{Base}/peasants/privapub/mouth", root.Json["inbox"]!.GetValue<string>());
+			Assert.Equal(HttpStatusCode.NotFound, browser.Status);
+		}
+
 		[Fact]
 		public async Task Users_moves_permanently_to_peasants_and_unknown_actors_are_404()
 		{
@@ -519,6 +533,7 @@ namespace PrivaPub.Tests.Http
 			var instance = await client.Fetch("/peasants/privapub");
 			Assert.Equal(HttpStatusCode.OK, instance.Status);
 			Assert.Equal("Application", instance.Json["type"]!.GetValue<string>());
+			Assert.Equal(HttpStatusCode.OK, (await client.Fetch("/")).Status);
 			foreach (var path in paths[..^1])
 				Assert.True((await client.Fetch(reader.SignedGet(path))).Status == HttpStatusCode.OK, $"{path} refused a signed GET");
 			// a browser is not asked for a signature: it is only sent to the public pages