chore(deps): update indigo to v0.0.0-20260202 and simplify OAuth scopes

Update bluesky-social/indigo dependency to the latest version and adapt
to its API changes. Also simplify OAuth configuration by removing the
deprecated transition:generic scope.

Changes:
- Update Go version from 1.24.0 to 1.25
- Update indigo to v0.0.0-20260202181658-ea3d39eec464
- Fix DID parsing calls to use value type instead of pointer (indigo API change)
- Remove transition:generic from OAuth scopes (now using atproto only)
- Fix test isolation in CleanupExpiredSessions test

Co-Authored-By: Claude Opus 4.5 <[e-mail]>

cmd/server/main.go

···
 	oauthConfig := &oauth.OAuthConfig{
 		PublicURL:       os.Getenv("APPVIEW_PUBLIC_URL"),
 		SealSecret:      oauthSealSecret,
-		Scopes:          []string{"atproto", "transition:generic"},
+		Scopes:          []string{"atproto"},
 		DevMode:         isDevMode,
 		AllowPrivateIPs: isDevMode, // Allow private IPs only in dev mode
 		PLCURL:          plcURL,

go.mod

···
 module Coves
 
-go 1.24.0
+go 1.25
 
 toolchain go1.25.1
 
 require (
-	github.com/bluesky-social/indigo v0.0.0-20251010013709-8f2296eee90f
+	github.com/bluesky-social/indigo v0.0.0-20260202181658-ea3d39eec464
 	github.com/disintegration/imaging v1.6.2
 	github.com/go-chi/chi/v5 v5.2.1
 	github.com/go-chi/cors v1.2.2

go.sum

···
 github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
-github.com/bluesky-social/indigo v0.0.0-20251010013709-8f2296eee90f h1:95XLfnirbj3yKv5zA2gYbUDrnZObG/1Irwmaw4ukLec=
-github.com/bluesky-social/indigo v0.0.0-20251010013709-8f2296eee90f/go.mod h1:GuGAU33qKulpZCZNPcUeIQ4RW6KzNvOy7s8MSUXbAng=
+github.com/bluesky-social/indigo v0.0.0-20260202181658-ea3d39eec464 h1:jL6cPOk1CZ8H06sEn+WFGWufHmqkawsGyDRl+BJhQjs=
+github.com/bluesky-social/indigo v0.0.0-20260202181658-ea3d39eec464/go.mod h1:VG/LeqLGNI3Ew7lsYixajnZGFfWPv144qbUddh+Oyag=
 github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
 github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=

internal/atproto/identity/base_resolver.go

···
 	}
 
 	// Resolve using Indigo's directory
-	ident, err := r.directory.Lookup(ctx, *atID)
+	ident, err := r.directory.Lookup(ctx, atID)
 	if err != nil {
 		// Check if it's a "not found" error
 		errStr := err.Error()

internal/atproto/oauth/dev_auth_resolver.go

···
 		if err != nil {
 			return "", fmt.Errorf("not a valid DID (%s): %w", identifier, err)
 		}
-		ident, err := dir.Lookup(ctx, *atid)
+		ident, err := dir.Lookup(ctx, atid)
 		if err != nil {
 			return "", fmt.Errorf("failed to resolve DID (%s): %w", identifier, err)
 		}
···
 		if err != nil {
 			return "", fmt.Errorf("not a valid DID (%s): %w", did, err)
 		}
-		ident, err := dir.Lookup(ctx, *atid)
+		ident, err := dir.Lookup(ctx, atid)
 		if err != nil {
 			return "", fmt.Errorf("failed to resolve DID document (%s): %w", did, err)
 		}

internal/atproto/oauth/store_test.go

···
 		HostURL:                 "https://pds2.example.com",
 		AuthServerURL:           "https://auth2.example.com",
 		AuthServerTokenEndpoint: "https://auth2.example.com/oauth/token",
-		Scopes:                  []string{"atproto", "transition:generic"},
+		Scopes:                  []string{"atproto"},
 		AccessToken:             "new_access_token",
 		RefreshToken:            "new_refresh_token",
 		DPoPPrivateKeyMultibase: "z6MkpTHR8VNsBxYAAWHut2Geadd9jSwuBV8xRoAnwWsdvktX",
···
 	assert.Equal(t, "new_access_token", retrieved.AccessToken)
 	assert.Equal(t, "new_refresh_token", retrieved.RefreshToken)
 	assert.Equal(t, "https://pds2.example.com", retrieved.HostURL)
-	assert.Equal(t, []string{"atproto", "transition:generic"}, retrieved.Scopes)
+	assert.Equal(t, []string{"atproto"}, retrieved.Scopes)
 }
 
 func TestPostgresOAuthStore_GetSession_NotFound(t *testing.T) {
···
 func TestPostgresOAuthStore_CleanupExpiredSessions(t *testing.T) {
 	db := setupTestDB(t)
 	defer func() { _ = db.Close() }()
-	// Clean up before AND after to ensure test isolation
-	cleanupOAuth(t, db)
 	defer cleanupOAuth(t, db)
 
 	storeInterface := NewPostgresOAuthStore(db, 0) // Use default TTL
···
 	require.True(t, ok, "store should be *PostgresOAuthStore")
 	ctx := context.Background()
 
+	// Pre-cleanup any expired sessions (from any source) to ensure the count
+	// assertion below returns exactly 1. cleanupOAuth only handles did:plc:test%
+	// records, but CleanupExpiredSessions operates on all expired sessions.
+	_, err := store.CleanupExpiredSessions(ctx)
+	require.NoError(t, err, "Failed to cleanup pre-existing expired sessions")
+
 	did1, err := syntax.ParseDID("did:plc:testexpired1")
 	require.NoError(t, err)
-	did2, err := syntax.ParseDID("did:plc:testexpired2")
+	var did2 syntax.DID
+	did2, err = syntax.ParseDID("did:plc:testexpired2")
 	require.NoError(t, err)
 
 	// Create an expired session (manually insert with past expiration)

static/client-metadata.json

···
     "https://coves.social/oauth/callback",
     "social.coves:/oauth/callback"
   ],
-  "scope": "atproto transition:generic",
+  "scope": "atproto",
   "grant_types": ["authorization_code", "refresh_token"],
   "response_types": ["code"],
   "application_type": "native",

tests/integration/oauth_e2e_test.go

···
 		SessionID:   fmt.Sprintf("localhost-test-%d", time.Now().UnixNano()),
 		HostURL:     "http://localhost:3001",
 		AccessToken: "mocked-access-token",
-		Scopes:      []string{"atproto", "transition:generic"},
+		Scopes:      []string{"atproto"},
 	}
 
 	err = store.SaveSession(ctx, testSession)
···
 		RequestURI:                   "http://localhost:3001/authorize",
 		AuthServerTokenEndpoint:      "http://localhost:3001/oauth/token",
 		AuthServerRevocationEndpoint: "http://localhost:3001/oauth/revoke",
-		Scopes:                       []string{"atproto", "transition:generic"},
+		Scopes:                       []string{"atproto"},
 	}
 
 	// Save auth request
···
 		RefreshToken:                 "initial-refresh-token",
 		DPoPPrivateKeyMultibase:      "test-dpop-key",
 		DPoPAuthServerNonce:          "test-nonce",
-		Scopes:                       []string{"atproto", "transition:generic"},
+		Scopes:                       []string{"atproto"},
 	}
 
 	// Save the session

tests/integration/oauth_helpers.go

···
 		config = &oauth.OAuthConfig{
 			PublicURL:       "http://localhost:3000", // Test server callback URL
 			SealSecret:      sealSecretB64,           // For sealing mobile tokens
-			Scopes:          []string{"atproto", "transition:generic"},
+			Scopes:          []string{"atproto"},
 			DevMode:         false, // Production mode for HTTPS PDS
 			AllowPrivateIPs: false, // No private IPs in production mode
 			PLCURL:          "",    // Use default PLC directory (plc.directory)
···
 		config = &oauth.OAuthConfig{
 			PublicURL:       "http://localhost:3000", // Match the callback URL expected by PDS
 			SealSecret:      sealSecretB64,           // For sealing mobile tokens
-			Scopes:          []string{"atproto", "transition:generic"},
+			Scopes:          []string{"atproto"},
 			DevMode:         true,            // Enable dev mode for localhost testing
 			AllowPrivateIPs: true,            // Allow private IPs for local testing
 			PLCURL:          getTestPLCURL(), // Use local PLC directory for DID resolution