app.bsky.* requests with no atproto-proxy header are rejected by default.
When server.default_appview (DEFAULT_APPVIEW) is set, proxy them to that
AppView instead, matching the reference PDS. Protected/local methods and
chat.bsky.* are unaffected; age-assurance override still wins.

Lewis: May this revision serve well! <lu5a@proton.me>

Lewis: May this revision serve well! <lu5a@proton.me>

Lewis: May this revision serve well! <lu5a@proton.me>

Lewis: May this revision serve well! <lu5a@proton.me>

Lewis: May this revision serve well! <lu5a@proton.me>

Lewis: May this revision serve well! <lu5a@proton.me>

Lewis: May this revision serve well! <lu5a@proton.me>

Collapse the three ad-hoc short-code generators into one canonical generator
plus a shared normalizer:

- util::generate_token_code now emits the uppercase base32 XXXXX-XXXXX display
form; new util::normalize_token_code canonicalizes user input (uppercase,
strip hyphen/whitespace).
- email_token and legacy_2fa now generate via util, store the normalized form,
and compare normalized input. Their private generate_short_token/generate_code
(and BASE32_CHARS/CODE_LENGTH) are removed.
- PLC (request/sign) and password reset inline util::generate_token_code,
persist the normalized form, email the display form, and normalize input
before lookup. The generate_plc_token/generate_reset_code wrappers are removed.

Behavior changes: legacy login-2FA codes go from 8-digit numeric to XXXXX-XXXXX;
PLC and password-reset codes go from lowercase to uppercase. All four code types
are now accepted case-/hyphen-insensitively. OAuth web-login 2FA, account
deletion, and the long verification_token blobs are intentionally untouched.

Tests: add util normalize tests + email_token/legacy_2fa case/hyphen tests;
update integration tests to expect the canonical stored form and the new
emailed format.

RFC 7519 §5.1 recommends the uppercase "JWT" typ for compatibility with
legacy implementations, and it matches the reference @atproto/pds. Parsing
already lowercases, so existing lowercase "jwt" tokens still verify.

Permission-set expansion resolved the lexicon's DNS authority using a
fixed `parts[..2]`, which only works for three-segment NSIDs. For a
four-segment NSID such as community.lexicon.bookmarks.authManageBookmarks
this dropped a segment and queried _lexicon.lexicon.community instead of
_lexicon.bookmarks.lexicon.community, failing with "DNS resolution
failed: ... no record found".

The authority is every NSID segment except the last (the name),
reversed. Use parts[..parts.len() - 1] to match the spec and the
existing extract_namespace_authority helper, and update the DNS
authority test with three/four-segment and bookmarks regression cases.

Lewis: May this revision serve well! <lu5a@proton.me>

Lewis: May this revision serve well! <lu5a@proton.me>

Lewis: May this revision serve well! <lu5a@proton.me>

Lewis: May this revision serve well! <lu5a@proton.me>

Lewis: May this revision serve well! <lu5a@proton.me>

Lewis: May this revision serve well! <lu5a@proton.me>

Lewis: May this revision serve well! <lu5a@proton.me>

Lewis: May this revision serve well! <lu5a@proton.me>

Lewis: May this revision serve well! <lu5a@proton.me>

Lewis: May this revision serve well! <lu5a@proton.me>

Lewis: May this revision serve well! <lu5a@proton.me>

Lewis: May this revision serve well! <lu5a@proton.me>

Lewis: May this revision serve well! <lu5a@proton.me>

Lewis: May this revision serve well! <lu5a@proton.me>

Lewis: May this revision serve well! <lu5a@proton.me>

Lewis: May this revision serve well! <lu5a@proton.me>

Lewis: May this revision serve well! <lu5a@proton.me>

Lewis: May this revision serve well! <lu5a@proton.me>

Lewis: May this revision serve well! <lu5a@proton.me>

Lewis: May this revision serve well! <lu5a@proton.me>

Lewis: May this revision serve well! <lu5a@proton.me>

Lewis: May this revision serve well! <lu5a@proton.me>

an attempt to make it so that fixes like
fc6063dba898707d309248aa41711b94e0838094 never have to occur again

Lewis: May this revision serve well! <lu5a@proton.me>

Lewis: May this revision serve well! <lu5a@proton.me>

Lewis: May this revision serve well! <lu5a@proton.me>

Lewis: May this revision serve well! <lu5a@proton.me>

Lewis: May this revision serve well! <lu5a@proton.me>

Lewis: May this revision serve well! <lu5a@proton.me>

Lewis: May this revision serve well! <lu5a@proton.me>

some future protections against this acursed toolchain breaking and
people who do .follows on their nixpkgs inputs