Pasture: Mobilizon joins

Mobilizon 5.2.4 on a PostGIS of its own (it needs the extension, which the shared Postgres has not got), trusting
Caddy's CA through the bundle mounted over certifi's and castore's files (hackney trusts only those), with geocoding
pointed at a closed local port. scenarios/mobilizon.sh passes its 23 checks: alice follows a group; the event its
organiser makes arrives as an Event with its start, end and located place; comments both ways; the organiser's edit,
closing the comments (PrivaPub then refuses a reply) and deletes of a comment and the event; a group post with its
title; the unfollow; statistics. An event made through Mobilizon's API without options has its comments closed, so
the scenario opens them. No RSVP yet.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

CLAUDE.md

@@ -546,6 +546,12 @@ tools/pasture/run.sh down                                            # removes e
   fetch that user from itself, signed, and checking the signature recurses for about five minutes. Its API takes HTTP
   Basic (`nick:password`); an edit through it never federates, so the scenario edits in the web editor.
   `scenarios/friendica.sh`, 25 checks; the town's driver and `specs/friendica-pair.json`.
+- **Mobilizon (5.2.4):** kaihuri's image of the release on a PostGIS of its own (`shared_postgis_up`: it needs the
+  extension), with the pasture's bundle mounted over certifi's and castore's CA files (hackney trusts only those) and
+  the system store, and geocoding pointed at a closed local port. `mobilizon_ctl users.new` makes mzuser (it splits
+  its arguments on spaces); the API is GraphQL (`/api`), signed in by the `login` mutation. An event made through it
+  without options has its comments closed. `scenarios/mobilizon.sh`, 23 checks: a group and its events (dates, place),
+  comments both ways, the organiser's edit, closed comments and deletes, a group post, the unfollow.
 - **SecureMode:** `PRIVAPUB_ENV="Federation__SecureMode=true" run.sh up …`, as production runs. A check of what an
   unsigned reader sees uses `unserved` and `gone_unsigned` (`lib/interop.sh`), which expect 401 when SecureMode is on and
   404 or 410 when it is off.