feat(at-identity): PdsHandleResolver for cluster-local DID→handle resolution

The AppView's handle_sync worker consulted the public PLC directory
and the did:web: HTTPS resolver only. DIDs hosted on the local PDS
(notably did🔑 users and any other operator-hosted method)
weren't reachable without an external round trip, and unresolvable
DIDs (did🔑 not on this PDS, did:foo: anything) blocked the
100-row batch forever because did🔑 sorts lexicographically
before did:plc: / did:web:.

This commit adds:

* `PdsHandleResolver` (at-identity) — POSTs the DID as the
  `handle` field to the PDS's resolveHandle XRPC method. The PDS
  now recognises a `did:` prefix and does a PK lookup on
  `users.did`, returning `{did, handle}`. The resolver reads
  the `handle` field, so the AppView finally gets a real local
  handle for did🔑 users without ever dialing plc.directory.
* A 2 s timeout per request (was 10 s) and `DISPATCH_CONCURRENCY =
  8` so the worker caps a 100-DID batch at ~2 s with parallel
  dispatch instead of the ~17 min worst case the old serial + 10 s
  setup allowed.
* A new `posts.handle_sync_attempted_at` column (migration 0006)
  and `mark_attempted()` helper. The SELECT filter excludes rows
  attempted within the last hour, so an unresolvable DID dominates
  at most one batch before the worker advances. Cleared on success.
* `PDS_INTERNAL_URL` config so the AppView can reach the PDS via
  a cluster-internal hostname when the public URL isn't routable
  from inside the cluster.

Tests:
* `crates/at-identity/src/pds_handle.rs` — 4 unit tests against a
  stub HTTP server (200/404/5xx/missing-did-field).
* Existing handle_sync integration tests updated to wire in the
  new `pds_resolver` field.

crates/appview/src/main.rs

@@ -86,8 +86,27 @@ async fn main() -> Result<()> {
         cfg.plc_directory_url.clone(),
     ));
     let web: Arc<dyn DidHandleResolver> = Arc::new(at_identity::WebResolver::new());
+    // PDS-local handle resolver. The handle_sync worker consults it
+    // first, before the public PLC/web resolvers, so `did:key:`
+    // users (and any other DID the operator hosts on this PDS) get their
+    // local handle without a round trip to plc.directory. A 404 from
+    // the PDS falls through to the public resolvers.
+    //
+    // Use the cluster-internal URL when configured (e.g. `http://pds:3000`
+    // inside docker compose) — `pds_public_url` may not be reachable
+    // from inside the cluster when TLS / DNS is set up for outside
+    // clients only.
+    let pds_base_url = cfg
+        .pds_internal_url
+        .clone()
+        .unwrap_or_else(|| cfg.pds_public_url.clone());
+    let pds_resolver: Arc<dyn at_identity::DidHandleResolver> = Arc::new(
+        at_identity::pds_handle::PdsHandleResolver::new(pds_base_url),
+    );
+
     let handle_sync = handle_sync::HandleSyncWorker {
         db: db.clone(),
+        pds_resolver,
         plc_resolver: plc,
         web_resolver: web,
         interval_secs: cfg.appview_handle_sync_interval_secs,