Add community, security categories and expand business/interpersonal/technical/creative
coverage to support non-technical profiles. Covers all skills present in the
unresolved_skills queue from real user imports.

New categories:
- community: Community Strategy, Building, Management, Engagement, Developer Relations,
Content Moderation, Platform Integrity, Open Source, Event Management
- security: Cybersecurity, Network Security, Incident Response, Vulnerability Management,
SIEM, IAM, Network Administration, Penetration Testing, and 11 more

Expanded categories:
- business: E-commerce, Conversion Optimization, SEO, A/B Testing, Digital Strategy,
Entrepreneurship, CRM, Knowledge Management, and 19 more
- interpersonal: Cross-functional Leadership, Stakeholder Management, Human Behavior,
Technical Leadership, Conflict Resolution, Persuasion, Research
- technical: Software Engineering, Web Development, Systems Design, Quality Assurance,
Generative AI, Spryker, Magento, Joomla, and 9 more
- creative: Usability (incl. 'user experience' alias)

* fix(profile): preserve createdAt and account metadata on account reset

Resetting an account wiped the entire profiles row, causing the user's
original join date to be overwritten with the current timestamp on next
login. This made reset users appear as new signups in admin stats and
reset growth data.

Replace db.delete(profiles) with db.update(profiles).set({...}) that
nulls only user-authored Sifa profile content (headline, about,
industry, location fields, openTo, preferredWorkplace). Preserves
createdAt, langs, headlineOverride, aboutOverride, handle, displayName,
avatarUrl, and pdsHost.

* style: format pnpm-lock.yaml

Every commit now auto-formats staged files via lint-staged + Prettier.
Prevents recurring CI failures from unformatted code reaching main.

Add Northsky and selfhosted.social as known PDS providers.
Change mapPdsHostToProvider to return { name: 'selfhosted', host }
for any resolved PDS host that doesn't match a known provider,
instead of returning null.

* fix(oauth): crash on startup when OAuth keys are missing

Instead of silently setting oauthClient to null and serving 503 on all
auth endpoints, throw a clear error during server initialization when
JWKS/private key files are missing or Valkey is unavailable. This
prevents deploying an API that looks healthy but cannot authenticate
users.

Test mode (NODE_ENV=test) still skips OAuth initialization.

Closes #92

* ci(deploy): add post-deploy health gate with OAuth verification

After deploying, poll /api/health/ready for up to 30s and verify the
OAuth endpoint returns a non-503 status. Fails the workflow if the API
doesn't become healthy or OAuth keys are missing.

* style: fix prettier formatting in metadata.ts

Users entering just a username (e.g. "jeroenwaelen") instead of the full
handle ("jeroenwaelen.bsky.social") would get an unhelpful error. Now the
login endpoint tries the bare input first, then retries with .bsky.social
appended. If all candidates fail, returns a descriptive error explaining
the expected format with examples.

Fetch Bluesky/AT Protocol follower counts via app.bsky.actor.getProfile
and include as `atprotoFollowersCount` in profile API responses. Uses
Valkey cache with 1-hour TTL to avoid rate limiting. Works for both
claimed and unclaimed profiles.

Closes singi-labs/sifa-web#224

* chore: add .worktrees to gitignore

* feat(api): detect PDS provider from DID document (#222)

Add server-side PDS host resolution by fetching DID documents from
plc.directory (did:plc) or .well-known/did.json (did:web). The resolved
PDS host is cached in a new `pds_host` column on the profiles table and
mapped to known providers (Bluesky, Blacksky, Eurosky).

The profile API response now includes a `pdsProvider` field with the
provider name and host, enabling the frontend to show correct provider
icons for users with custom domain handles.

* fix: deduplicate .worktrees gitignore, log pdsHost cache errors

* fix(pds-provider): address self-review findings

- Use shared logger singleton instead of direct pino import
- Validate DID documents with @atproto/common-web's isValidDidDoc
- Handle did:web path segments per W3C DID spec
- Move resolvePdsHost into parallel Promise.all to avoid serial await
- Update tests for renamed extractPdsHostFromEndpoint and add did:web path test

* style: format pds-provider files with prettier

Mirror main branch to tangled.org on every push, matching
the setup used by Barazo repos.

AT Protocol handles are domain names (RFC 1035) and therefore
case-insensitive. The profile lookup route used a direct equality check
which was case-sensitive in PostgreSQL. Normalize the input handle to
lowercase before querying.