- Replace use_resource with use_server_future in dashboard to avoid
hydration mismatch (server-rendered data matches client on first render)
- Remove use_context call inside onclick handler in Home component —
hooks must only be called at render-phase top level; use the
already-captured session signal instead

Uses Dioxus's #[get] macro to serve the client metadata JSON at
/oauth/client-metadata.json. The endpoint is registered automatically
through Dioxus's inventory mechanism.

Changes:
- Add global singleton signing key (LazyLock<KeyData>) and make
base_url() pub(crate) in oauth.rs
- Fix HTTPS client_id to point at /oauth/client-metadata.json instead
of the callback URL
- Add ClientMetadata type in types.rs using serde_json::Value for jwks
to avoid depending on atproto-oauth on the WASM side
- Add #[get] server function in server_fns.rs that builds and returns
the metadata with inline JWKS

- Replace manual PAR/token exchange/DPoP/JWT code with library calls
- oauth_init() handles PAR, DPoP, client assertions automatically
- oauth_complete() handles token exchange, PKCE, nonce retry
- Remove build_client_assertion, TokenResult enum, manual retry logic
- Add #[cf_attr] guards to prevent cargo fix from stripping WASM-only imports

- Remove APP_REGISTRY and hardcoded app metadata
- Derive display name by reversing/capitalizing NSID prefix
- Derive URL by reversing NSID prefix (https://reversed.domain)
- Derive icon and color deterministically from prefix hash
- Remove description field from app cards
- Sort apps alphabetically
- Clickable app name/icon opens in new tab

- Add AT Protocol OAuth 2.0 login flow (PAR, DPoP, JWT client assertions)
- Resolve handles to DIDs, discover PDS and auth server metadata
- Scan user repos via com.atproto.repo.describeRepo with DPoP auth
- Display discovered AT Protocol apps in CSS masonry grid
- Map known NSID prefixes to app names, icons, and descriptions
- Single-page layout: login screen or dashboard with logout
- Catppuccin Mocha dark theme with custom Tailwind tokens
- Remove Dioxus template boilerplate (blog, echo, hero, navbar)
- Server functions for all AT Protocol operations
- Backend OAuth state persistence in server-side HashMap
- DPoP nonce retry for token endpoint

Dependencies: atproto-identity, atproto-oauth, reqwest (server-only)