feat: Implement Pushed Authorization Requests (PAR) for OAuth migration and proxy missing repo records to AppView.

frontend/src/lib/migration/atproto-client.ts

···
       return null;
     }
 
-    const authServerUrl = `${
-      authServers[0]
-    }/.well-known/oauth-authorization-server`;
+    const authServerUrl = `${authServers[0]
+      }/.well-known/oauth-authorization-server`;
     const authServerRes = await fetch(authServerUrl);
     if (!authServerRes.ok) {
       return null;
···
   return url.toString();
 }
 
+export function buildParAuthorizationUrl(
+  metadata: OAuthServerMetadata,
+  clientId: string,
+  requestUri: string,
+): string {
+  const url = new URL(metadata.authorization_endpoint);
+  url.searchParams.set("client_id", clientId);
+  url.searchParams.set("request_uri", requestUri);
+  return url.toString();
+}
+
+export async function pushAuthorizationRequest(
+  metadata: OAuthServerMetadata,
+  params: {
+    clientId: string;
+    redirectUri: string;
+    codeChallenge: string;
+    state: string;
+    scope?: string;
+    dpopJkt?: string;
+    loginHint?: string;
+  },
+  dpopKeyPair: DPoPKeyPair,
+): Promise<{ request_uri: string; expires_in: number }> {
+  if (!metadata.pushed_authorization_request_endpoint) {
+    throw new Error("Server does not support PAR");
+  }
+
+  const body = new URLSearchParams({
+    response_type: "code",
+    client_id: params.clientId,
+    redirect_uri: params.redirectUri,
+    code_challenge: params.codeChallenge,
+    code_challenge_method: "S256",
+    state: params.state,
+    scope: params.scope ?? "atproto",
+  });
+
+  if (params.dpopJkt) {
+    body.set("dpop_jkt", params.dpopJkt);
+  }
+  if (params.loginHint) {
+    body.set("login_hint", params.loginHint);
+  }
+
+  const makeRequest = async (nonce?: string): Promise<Response> => {
+    const dpopProof = await createDPoPProof(
+      dpopKeyPair,
+      "POST",
+      metadata.pushed_authorization_request_endpoint!,
+      nonce,
+    );
+
+    return fetch(metadata.pushed_authorization_request_endpoint!, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        DPoP: dpopProof,
+      },
+      body: body.toString(),
+    });
+  };
+
+  let res = await makeRequest();
+
+  if (!res.ok) {
+    const err = await res.json().catch(() => ({
+      error: "par_error",
+      error_description: res.statusText,
+    }));
+
+    if (err.error === "use_dpop_nonce") {
+      const dpopNonce = res.headers.get("DPoP-Nonce");
+      if (dpopNonce) {
+        res = await makeRequest(dpopNonce);
+        if (!res.ok) {
+          const retryErr = await res.json().catch(() => ({
+            error: "par_error",
+            error_description: res.statusText,
+          }));
+          throw new Error(
+            retryErr.error_description || retryErr.error || "PAR request failed",
+          );
+        }
+        return res.json();
+      }
+    }
+
+    throw new Error(
+      err.error_description || err.error || "PAR request failed",
+    );
+  }
+
+  return res.json();
+}
+
 export async function exchangeOAuthCode(
   metadata: OAuthServerMetadata,
   params: {
···
           }));
           throw new Error(
             retryErr.error_description || retryErr.error ||
-              "Token exchange failed",
+            "Token exchange failed",
           );
         }
         return res.json();
···
 
     if (handle.endsWith(".bsky.social")) {
       const res = await fetch(
-        `https://public.api.bsky.app/xrpc/com.atproto.identity.resolveHandle?handle=${
-          encodeURIComponent(handle)
+        `https://public.api.bsky.app/xrpc/com.atproto.identity.resolveHandle?handle=${encodeURIComponent(handle)
         }`,
       );
       if (!res.ok) {

frontend/src/lib/migration/flow.svelte.ts

···
 import {
   AtprotoClient,
   buildOAuthAuthorizationUrl,
+  buildParAuthorizationUrl,
   clearDPoPKey,
   createLocalClient,
   exchangeOAuthCode,
···
   getMigrationOAuthRedirectUri,
   getOAuthServerMetadata,
   loadDPoPKey,
+  pushAuthorizationRequest,
   resolvePdsUrl,
   saveDPoPKey,
 } from "./atproto-client";
···
     localStorage.setItem("migration_source_handle", state.sourceHandle);
     localStorage.setItem("migration_oauth_issuer", metadata.issuer);
 
-    const authUrl = buildOAuthAuthorizationUrl(metadata, {
-      clientId: getMigrationOAuthClientId(),
-      redirectUri: getMigrationOAuthRedirectUri(),
-      codeChallenge,
-      state: oauthState,
-      scope: "atproto identity:* rpc:com.atproto.server.createAccount?aud=*",
-      dpopJkt: dpopKeyPair.thumbprint,
-      loginHint: state.sourceHandle,
-    });
+    let authUrl: string;
+
+    if (metadata.pushed_authorization_request_endpoint) {
+      migrationLog("initiateOAuthLogin: Using PAR flow");
+      const parResponse = await pushAuthorizationRequest(
+        metadata,
+        {
+          clientId: getMigrationOAuthClientId(),
+          redirectUri: getMigrationOAuthRedirectUri(),
+          codeChallenge,
+          state: oauthState,
+          scope: "atproto identity:* rpc:com.atproto.server.createAccount?aud=*",
+          dpopJkt: dpopKeyPair.thumbprint,
+          loginHint: state.sourceHandle,
+        },
+        dpopKeyPair
+      );
+
+      authUrl = buildParAuthorizationUrl(
+        metadata,
+        getMigrationOAuthClientId(),
+        parResponse.request_uri
+      );
+    } else {
+      migrationLog("initiateOAuthLogin: Using standard OAuth flow");
+      authUrl = buildOAuthAuthorizationUrl(metadata, {
+        clientId: getMigrationOAuthClientId(),
+        redirectUri: getMigrationOAuthRedirectUri(),
+        codeChallenge,
+        state: oauthState,
+        scope: "atproto identity:* rpc:com.atproto.server.createAccount?aud=*",
+        dpopJkt: dpopKeyPair.thumbprint,
+        loginHint: state.sourceHandle,
+      });
+    }
 
     migrationLog("initiateOAuthLogin: Redirecting to authorization", {
       sourcePdsUrl: state.sourcePdsUrl,

frontend/src/lib/migration/types.ts

···
   issuer: string;
   authorization_endpoint: string;
   token_endpoint: string;
+  pushed_authorization_request_endpoint?: string;
+  require_pushed_authorization_requests?: boolean;
   scopes_supported?: string[];
   response_types_supported?: string[];
   grant_types_supported?: string[];

src/api/repo/record/read.rs

···
                         .into_response();
                 }
             }
-            return (
-                StatusCode::NOT_FOUND,
-                Json(json!({"error": "RepoNotFound", "message": "Repo not found"})),
-            )
-                .into_response();
+            let appview_endpoint = std::env::var("BSKY_APPVIEW_ENDPOINT")
+                .unwrap_or_else(|_| "https://api.bsky.app".to_string());
+            let mut url = format!(
+                "{}/xrpc/com.atproto.repo.getRecord?repo={}&collection={}&rkey={}",
+                appview_endpoint.trim_end_matches('/'),
+                urlencoding::encode(&input.repo),
+                urlencoding::encode(&input.collection),
+                urlencoding::encode(&input.rkey)
+            );
+            if let Some(cid) = &input.cid {
+                url.push_str(&format!("&cid={}", urlencoding::encode(cid)));
+            }
+            info!(
+                "Repo not found locally. Proxying getRecord for {} to AppView: {}",
+                input.repo, url
+            );
+            match proxy_client().get(&url).send().await {
+                Ok(resp) => {
+                    let status = resp.status();
+                    let body = match resp.bytes().await {
+                        Ok(b) => b,
+                        Err(e) => {
+                            error!("Error reading AppView proxy response: {:?}", e);
+                            return (
+                                StatusCode::BAD_GATEWAY,
+                                Json(json!({
+                                    "error": "UpstreamFailure",
+                                    "message": "Error reading upstream response from AppView"
+                                })),
+                            )
+                                .into_response();
+                        }
+                    };
+                    return Response::builder()
+                        .status(status)
+                        .header("content-type", "application/json")
+                        .body(axum::body::Body::from(body))
+                        .unwrap_or_else(|_| {
+                            (StatusCode::INTERNAL_SERVER_ERROR, "Internal error").into_response()
+                        });
+                }
+                Err(e) => {
+                    error!("Error proxying request to AppView: {:?}", e);
+                    return (
+                        StatusCode::BAD_GATEWAY,
+                        Json(json!({
+                            "error": "UpstreamFailure",
+                            "message": "Failed to reach AppView"
+                        })),
+                    )
+                        .into_response();
+                }
+            }
         }
         Err(_) => {
             return (