Wire the client to PrivaPub: one sign-in, real feeds, a globe, nerd stats

One sign-in for both of PrivaPub's APIs: the root logs in on /clientapi,
picks a persona, and each persona gets its own Mastodon token in
exchange for the JWT (PersonaExchange). HttpService picks credentials
and JSON by route (JWT and camelCase for /clientapi, the persona token
and snake_case for /api, nothing for /oauth), retries a refused persona
token once, and records every request for the nerd stats.

The feed page is three columns: navigation with a persona switcher, the
feed with a tab per kind (home, local, federated, nearby, communities
and circles, direct, notifications, favourites, bookmarks, hashtags),
and a 3D globe that looks at the spherical mean of the posts in view
and draws a pulse and an arc to a hovered one. Posts sit at their own
place, their event's venue, the reader (located posts) or their
author's server as PrivaPub publishes it. Cards favourite, boost,
bookmark, reply, mute, block and delete; the composer posts with a
content warning, visibility, media and alt text, or as a located post.
Older pages load as the end nears; newer ones are polled while visible.
Nerd stats in tooltips: provenance, author and server, place, media,
counts, paging, the globe's camera and frame rate.

The mock (Faker, MessagesService, the Message models and store) and the
OIDC template leftovers are gone. Strings in English and Italian.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

Models/APIs.cs

@@ -0,0 +1,65 @@
+namespace decePubClient.Models;
+
+/// <summary>
+/// Every PrivaPub route the client calls, relative to AppConfiguration.ApiBaseAddress (b2b.next's naming: the HTTP
+/// method first, _M_ for a route built from parameters). HttpService picks the credentials from the prefix:
+/// clientapi/ the root's JWT, api/ the current persona's Mastodon token, oauth/ none.
+/// </summary>
+public static class APIs
+{
+	public const string ClientApiPrefix = "clientapi/";
+	public const string MastodonPrefix = "api/";
+	public const string OAuthPrefix = "oauth/";
+
+	public static class ClientApi
+	{
+		public const string POST_Login = "clientapi/user/login";
+		public const string GET_Logout = "clientapi/user/logout";
+		public const string GET_SniffAgain = "clientapi/user/sniff/again";
+		public const string GET_CurrentVersion = "clientapi/data/current-version";
+		public const string GET_Personas = "clientapi/avatar/private/list";
+		public const string GET_Groups = "clientapi/group/list";
+		public const string GET_Posts = "clientapi/post/list";
+		public const string GET_Nearby = "clientapi/post/nearby";
+		public const string POST_InsertPost = "clientapi/post/insert";
+	}
+
+	public static class OAuth
+	{
+		public const string POST_Token = "oauth/token";
+		public const string POST_Revoke = "oauth/revoke";
+		public const string TokenExchangeGrant = "urn:ietf:params:oauth:grant-type:token-exchange";
+		public const string JwtTokenType = "urn:ietf:params:oauth:token-type:jwt";
+		public const string Scopes = "read write follow";
+	}
+
+	public static class Mastodon
+	{
+		public const string GET_VerifyCredentials = "api/v1/accounts/verify_credentials";
+		public const string GET_HomeTimeline = "api/v1/timelines/home";
+		public const string GET_PublicTimeline = "api/v1/timelines/public";
+		public const string GET_Statuses = "api/v1/statuses";
+		public const string POST_Statuses = "api/v1/statuses";
+		public const string GET_Favourites = "api/v1/favourites";
+		public const string GET_Bookmarks = "api/v1/bookmarks";
+		public const string GET_Conversations = "api/v1/conversations";
+		public const string GET_Notifications = "api/v1/notifications";
+		public const string POST_Media = "api/v2/media";
+
+		public static string GET_M_TagTimeline(string tag) => $"api/v1/timelines/tag/{Uri.EscapeDataString(tag)}";
+		public static string GET_M_Account(string accountId) => $"api/v1/accounts/{Uri.EscapeDataString(accountId)}";
+		public static string GET_M_AccountStatuses(string accountId) => $"api/v1/accounts/{Uri.EscapeDataString(accountId)}/statuses";
+		public static string GET_M_Status(string statusId) => $"api/v1/statuses/{Uri.EscapeDataString(statusId)}";
+		public static string GET_M_Context(string statusId) => $"api/v1/statuses/{Uri.EscapeDataString(statusId)}/context";
+		public static string DELETE_M_Status(string statusId) => $"api/v1/statuses/{Uri.EscapeDataString(statusId)}";
+		public static string POST_M_StatusAction(string statusId, string action) => $"api/v1/statuses/{Uri.EscapeDataString(statusId)}/{action}";
+		public static string POST_M_AccountAction(string accountId, string action) => $"api/v1/accounts/{Uri.EscapeDataString(accountId)}/{action}";
+	}
+
+	public static class PrivaPub
+	{
+		public const string GET_Instances = "api/privapub/v1/instances";
+
+		public static string GET_M_Provenance(string statusId) => $"api/privapub/v1/statuses/{Uri.EscapeDataString(statusId)}/provenance";
+	}
+}