Everything on, phase 2 completed: SecureMode on in production, checked by the deploy

Owner decision 2026-10-04: SecureMode on once the pasture passes with it.

- Both clean pasture passes were run over all six peers:
  - normally: 246 passed, 0 failed;
  - with Federation__SecureMode=true: every federation check passed. The only failures were four checks expecting an
    unsigned GET to get 404 or 410 where SecureMode answers 401. Those checks now go through `unserved` and
    `gone_unsigned` (lib/interop.sh), which expect 401 when SecureMode is on.
- Circle posts now reach their member on GoToSocial and Mastodon, and survive Mastodon's signed refetch, as does a
  followers-only post. The GoToSocial expected failure is gone.
- appsettings.Production.json turns SecureMode on.
- The deploy now checks that an unsigned GET of @thepra answers 401 and that a browser is redirected. It reads
  @thepra's discoverability through the Mastodon API, since the actor is no longer readable unsigned.
- docs/INTEROP.md (Mastodon, GoToSocial), CLAUDE.md and ROADMAP updated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ELjqpznMFMNrJoJUj6K5p2

tools/pasture/scenarios/gts.sh

@@ -170,7 +170,7 @@ circle_uri=$(podman exec pasture-mongo mongosh --quiet PrivaPub --eval 'print(db
 # is then in gtsuser's conversations, never in a search by URI.
 until_true 15 'gcurl -s -H "$GH" "$G/api/v1/conversations" | grep -q "only the circle on GoToSocial sees this"' \
 	&& ok "a circle post, naming its member, reaches its GoToSocial member" || ko "circle post missing on GoToSocial" 
-[ "$(pfetch -o /dev/null -w '%{http_code}' -H 'Accept: application/activity+json' "$circle_uri")" = "404" ] && ok "the circle post is not served unsigned" || ko "circle post served unsigned"
+unserved "$circle_uri" && ok "the circle post is not served unsigned" || ko "circle post served unsigned"
 
 echo "locked personas"
 LT=$(privapub_token locked_alice); LH="Authorization: Bearer $LT"