getServiceToken already throws SessionExpiredError when the PDS rejects the service auth request, which propagates before the API call happens. If getServiceToken succeeds but the API returns 401 (wrong API_DID, clock skew, etc.), the user's PDS session is still valid — calling signOut() would revoke it unnecessarily. Surface these as generic errors instead, consistent with listPublications and listSubscriptions.

When a post is re-indexed (e.g. after a publication rename or repeated backfill),
upsertDocument was overwriting GSI1SK with a new Date.now()-clamped value. Because
fanInExistingPosts uses GSI1SK as the timeline SK, two subscribes separated by a
re-index would produce two differently-keyed timeline items for the same post rkey.

Fix: read the existing GSI1SK before writing; only compute a new value if the record
doesn't exist yet. This makes GSI1SK write-once and keeps fan-in idempotent across
re-indexes.

Store resolvedHandle on publication DynamoDB records (indexer, backfill, API createPublication) and return it from listPublications and listSuggestions

Fan-in writes timeline item SKs using the post's stored GSI1SK
(already clamped to index time) instead of recomputing Date.now()
at write time. This matches the existing behaviour of the recent
feed and prevents duplicates: both the API Lambda and the indexer
trigger fan-in on subscription, and using Date.now() independently
produced two items with slightly different SKs for the same post.