Wire the client to PrivaPub: one sign-in, real feeds, a globe, nerd stats

One sign-in for both of PrivaPub's APIs: the root logs in on /clientapi,
picks a persona, and each persona gets its own Mastodon token in
exchange for the JWT (PersonaExchange). HttpService picks credentials
and JSON by route (JWT and camelCase for /clientapi, the persona token
and snake_case for /api, nothing for /oauth), retries a refused persona
token once, and records every request for the nerd stats.

The feed page is three columns: navigation with a persona switcher, the
feed with a tab per kind (home, local, federated, nearby, communities
and circles, direct, notifications, favourites, bookmarks, hashtags),
and a 3D globe that looks at the spherical mean of the posts in view
and draws a pulse and an arc to a hovered one. Posts sit at their own
place, their event's venue, the reader (located posts) or their
author's server as PrivaPub publishes it. Cards favourite, boost,
bookmark, reply, mute, block and delete; the composer posts with a
content warning, visibility, media and alt text, or as a located post.
Older pages load as the end nears; newer ones are polled while visible.
Nerd stats in tooltips: provenance, author and server, place, media,
counts, paging, the globe's camera and frame rate.

The mock (Faker, MessagesService, the Message models and store) and the
OIDC template leftovers are gone. Strings in English and Italian.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

Models/AuthData.cs

@@ -1,22 +1,24 @@
 namespace decePubClient.Models
 {
+	/// <summary>
+	/// The signed-in session, kept in localStorage: the root's /clientapi JWT and, per persona the client used, the
+	/// Mastodon token PrivaPub issued for it in exchange (one token per persona, never naming the root).
+	/// </summary>
 	public class AuthData
 	{
+		/// <summary>The root's JWT, for /clientapi and for exchanging persona tokens.</summary>
 		public string Token { get; set; }
+		/// <summary>When the JWT expires, in .NET ticks (JwtUser.Expiration).</summary>
 		public long? TokenExpiration { get; set; }
+		/// <summary>When the client received the JWT, in .NET ticks: with TokenExpiration, how long PrivaPub's tokens last.</summary>
+		public long? TokenIssuedAt { get; set; }
 		public string CurrentLanguageCode { get; set; } = "en";
-		public User User { get; set; }
-
-		//public bool UserHasPolicies(params string[] policies)
-		//{
-		//	var hasAllPolicies = true;
-		//	foreach (var policy in policies)
-		//		if (!(User?.Policies?.Any(p => p == policy) ?? false))
-		//		{
-		//			hasAllPolicies = false;
-		//			break;
-		//		}
-		//	return hasAllPolicies;
-		//}
+		/// <summary>The root's login name; shown only to its owner.</summary>
+		public string UserName { get; set; }
+		public List<string> Policies { get; set; } = [];
+		/// <summary>The avatar id of the persona the client acts as.</summary>
+		public string PersonaId { get; set; }
+		/// <summary>Avatar id → that persona's Mastodon access token.</summary>
+		public Dictionary<string, string> PersonaTokens { get; set; } = [];
 	}
 }