Update all integration tests to use singular .community. naming convention
instead of .communities.

Tests updated:
- E2E community creation and XRPC endpoint tests
- HostedBy security validation tests
- Community provisioning tests
- Service integration tests
- V2 validation tests
- Token refresh tests

Changes:
- Update expected handle formats in assertions
- Update test fixtures to use new convention
- Ensure regex patterns match .community. format

All tests passing with new handle format.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Update PDS provisioning and Jetstream consumer to generate handles
using singular .community. instead of .communities.

Changes:
- PDSAccountProvisioner: Generate {name}.community.{domain} handles
- JetstreamConsumer: Parse and validate new handle format
- Update handle extraction logic for consistency

Example handle formats:
- gardening.community.coves.social
- gaming.community.coves.social

This maintains consistency with the lexicon schema update and aligns
with AT Protocol naming conventions.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Update AT Protocol lexicon schema and test data to use singular
.community. instead of .communities. in handle format.

Changes:
- Update profile.json lexicon schema with new handle pattern
- Update test fixtures to use singular convention
- Update lexicon validation tests

This aligns with AT Protocol naming standards where all record types
use singular form (e.g., app.bsky.feed.post, app.bsky.graph.follow).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Add production-ready migration script to update existing community handles
from plural (.communities.) to singular (.community.) format.

Migration features:
- Safe UPDATE using REPLACE for targeted changes
- Verification checks to ensure migration completion
- Rollback script for emergency reversion
- Error handling with informative messages

Example transformations:
- gardening.communities.coves.social → gardening.community.coves.social
- gaming.communities.coves.social → gaming.community.coves.social

This migration is required for the .communities → .community naming
convention change to align with AT Protocol lexicon standards
(all record types use singular form).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Add 31 test cases covering all identifier resolution code paths:

TestCommunityIdentifierResolution (14 E2E tests):
- DID format resolution (3 tests)
- Canonical handle format (3 tests)
- At-identifier format (2 tests)
- Scoped format !name@instance (5 tests)
- Edge cases (4 tests)

TestResolveScopedIdentifier_InputValidation (9 tests):
- Reject special characters, spaces, invalid DNS labels
- Reject names starting/ending with hyphens
- Reject names exceeding 63 character DNS limit
- Accept valid alphanumeric names with hyphens/numbers
- Validate domain format

TestGetDisplayHandle (5 tests):
- Standard two-part domains
- Multi-part TLDs (e.g., .co.uk)
- Subdomain instances
- Malformed input graceful fallback

TestIdentifierResolution_ErrorContext (3 tests):
- Verify error messages include identifier for debugging
- Verify DID, handle, and scoped errors provide context

Fixes:
- Use environment variables for configuration (no hardcoded coves.social)
- Correct NewPDSAccountProvisioner argument order (instanceDomain, pdsURL)
- Support self-hosted instances via INSTANCE_DOMAIN env var

All tests passing with real PDS integration.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Critical fixes:
- Fix GetDisplayHandle() to handle multi-part domains correctly using string.Index
- Add DNS label validation (RFC 1035) with isValidDNSLabel helper
- Add domain format validation with isValidDomain helper
- Normalize instanceDomain to lowercase for case-insensitive lookup
- Improve error messages to include identifier context for debugging

Validation improvements:
- Reject special characters in community names
- Enforce DNS label length limits (1-63 chars)
- Prevent names starting/ending with hyphens
- Validate domain format before lookup

Bug fixes:
- GetDisplayHandle now correctly parses handles with multi-part TLDs (e.g., coves.co.uk)
- resolveScopedIdentifier properly normalizes domain case (!gardening@Coves.social works)
- Error messages now include the identifier that failed resolution

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>