experimental webfinger support for OIDC

[axfelix]

Playing with this in re: https://bsky.app/profile/apenwarr.ca/post/3mci727zgxk2s

I lean toward thinking we want this endpoint on the PDS itself but mostly trying to keep the conversation going :)

[ThisIsMissEm]

So the goal is to support an external service that does OIDC for the PDS as an authorisation server? So you can login with your handle?

why not @handle.domain@atlogin.com?

because the discovery of the webfinger endpoint comes from the second @ piece.

@username@server

You probably don't want @thisismissem.social@puffball.us-east.host.bsky.network or @thisismissem.social@bsky.social as the webfinger handle, right?

[axfelix]

Yeah, I agree, this is the gnarly part — fundamentally different handle formatting expectations. With this last commit I've tried to make that as clean as I think I can get it with just the PDS as a surface for testing this, in a way that is usable for now as we decide how we want to support this.