# Conflicts:
# src/app.ts
# src/identity.ts
# src/index.ts

Implement L3: welcome-mat v1.0 signup flow with DPoP proof validation,
self-signed access token verification, and Hono auth middleware.

New files:
- src/auth.ts: DPoP/JWT validation, JWK thumbprint, auth middleware
- src/app.ts: createApp factory with all route definitions
- src/identity.ts: did:plc creation stub (L2 will replace internals)
- test/auth.test.ts: 19 tests covering signup, rejection cases, middleware

Changes:
- src/config.ts: add tosText field, ROOKERY_TOS_PATH support
- src/db.ts: add UNIQUE constraints on handle and jwk_thumbprint
- src/index.ts: thin entry point delegating to createApp

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

# Conflicts:
# src/index.ts

Implement L2 identity layer: PLC genesis operation construction and
signing, DID derivation, handle resolution via XRPC endpoint, and
.well-known/atproto-did endpoint. Extract app creation into src/app.ts
for testability. Add unique index on accounts(handle).