fix: resolve app credentials PDS URL #196

Fixes #55 — app-password credentials from env vars no longer assume bsky.social.

When ATP_IDENTIFIER + ATP_APP_PASSWORD are set without PDS_URL, Sequoia now resolves the identifier's DID document and uses the PDS listed there, so self-hosted PDS users work out of the box (matching what the docs already claimed).

• Added src/lib/identity.ts: identity resolution moved out of atproto.ts (which imports @atproto/api) so credentials.ts can use it without the heavy dependency.
• loadCredentials env branch: PDS_URL || await resolvePdsUrlOrDefault(identifier). An explicit PDS_URL still wins with no network call.
• Handle resolution now normalizes identifiers (strips leading @, trims, lowercases) and falls back to https://<handle>/.well-known/atproto-did when the Bluesky appview can't resolve — relevant for self-hosted handles.
• Falls back to bsky.social with a warning naming PDS_URL when the identifier isn't resolvable (e.g. an email login) or the lookup fails, so existing setups don't break.
• auth.ts / login.ts import the resolvers from ../lib/identity.
• Docs: note the auto-resolution and the email caveat in workflows.mdx.
• Tests: 13 new tests in test/identity.test.ts and test/credentials.test.ts (appview path, well-known fallback, did:plc/did:web docs, email + failure fallbacks, PDS_URL precedence). Full suite 94 pass / 0 fail; tsc --noEmit clean.