indices are unstable; switch to maps everywhere

Setup verification emails and future transactional emails using
Resend.

Wonder how many people were misled by this.

closes #42 by stripping one leading slash from the repo parameter.

also fixes a minor issue with the nix develop shellhook.

this kinda hacky fix is tested with the following commands:

```
nix build .#repoguard
SSH_ORIGINAL_COMMAND="git-upload-pack '/soopy.moe/test-repo'" ./result/bin/repoguard -log-path /tmp/ASDUJBIf-repoguard.log -user git
SSH_ORIGINAL_COMMAND="git-upload-pack 'soopy.moe/test-repo'" ./result/bin/repoguard -log-path /tmp/ASDUJBIf-repoguard.log -user git
```

No need to restart all subscribers when we get a new wantedDid.

Introduces rebalancing of dids across multiple subscribers if we exceed
a threshold of 100 wantedDids.

Turns out jetstream has a limit that we hit with our 300+ subscriptions
in a single query.

Otherwise it conflicts with the first created existing user

path-extractor in the router should use an escaped path

Users of the knotserver module not using `nixos-unstable` faces the error linked below when rebuilding their system. Removing the usage of overlays, and instead using the existing `self.packages` functionality allow packages to be less dependent on the user's configuration, avoids a pitfall like this and is thus more reproducible.

This patch also fixes the appview module referencing a non-existent package.

This patch also removes redundant usages of `with final;` and includes some minor formatting done by alejandra.

Minimum example: https://akyuu.soopy.moe/dGNHld.nix
Example build failure with master branch tip: https://akyuu.soopy.moe/4aNh8c.txt

Thanks to @ducky.ws, this changes GetAvatarUri to fetch it directly from the PDS.

the "http" and "ssh" chips were block elements and not inline elements, and would grow according to other items in the flexbox. this pull reworks the clone-card to make chips inline, and enables overflow for urls.

needs frontend bits

- fix up filters
- fix missing icons bug
- fix missing close button

Can't use sh.tangled.repo.pull.state.{open,closed,merged} since
that results in a stateopen.go -- overwriting issue.state.open etc.
Hence, it's pull.status.

/:did/:repo/merge is only ever used when actually performing the merge,
so by this point all conflicts should've been rectified and the merge
*should* succeed. This is the appview's responsibility.

/:did/:repo/merge/check checks for mergeability, and can be used to
repeatedly check as the supplied patch is updated by the submitter.

It's not appropriate to put binaries in /; binaries installed external
to the package manager should be installed in /usr/local/bin or
/usr/local/libexec on most systems. Since it's not meant to be executed
by users directly, it's probably more appropriate to be in libexec;
also, since "keyfetch" is a rather generic name, it's probably better to
rename it as "tangled-keyfetch".

Signed-off-by: Runxi Yu <me@runxiyu.org>