fix(compose): use HTTPS Note ID and add to/cc on Create activity

Mastodon silently discards activities with urn:uuid: IDs since they
can't be dereferenced. Use an HTTPS URL under our domain instead.

Also add to/cc (Public + followers) on the Create wrapper activity,
not just the Note object — Mastodon requires addressing on both.

lib/controllers/compose.js

@@ -195,9 +195,14 @@ export function submitComposeController(mountPath, plugin) {
           { handle, publicationUrl: plugin._publicationUrl },
         );
 
-        const noteId = `urn:uuid:${crypto.randomUUID()}`;
+        const uuid = crypto.randomUUID();
+        const baseUrl = plugin._publicationUrl.replace(/\/$/, "");
+        const noteId = `${baseUrl}/activitypub/quick-replies/${uuid}`;
         const actorUri = ctx.getActorUri(handle);
 
+        const publicAddress = new URL(
+          "https://www.w3.org/ns/activitystreams#Public",
+        );
         const followersUri = ctx.getFollowersUri(handle);
         const note = new Note({
           id: new URL(noteId),
@@ -205,7 +210,7 @@ export function submitComposeController(mountPath, plugin) {
           content: content.trim(),
           inReplyTo: inReplyTo ? new URL(inReplyTo) : undefined,
           published: Temporal.Now.instant(),
-          to: new URL("https://www.w3.org/ns/activitystreams#Public"),
+          to: publicAddress,
           cc: followersUri,
         });
 
@@ -213,6 +218,8 @@ export function submitComposeController(mountPath, plugin) {
           id: new URL(`${noteId}#activity`),
           actor: actorUri,
           object: note,
+          to: publicAddress,
+          cc: followersUri,
         });
 
         // Send to followers

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rmdes/indiekit-endpoint-activitypub",
-  "version": "2.0.3",
+  "version": "2.0.4",
   "description": "ActivityPub federation endpoint for Indiekit via Fedify. Adds full fediverse support: actor, inbox, outbox, followers, following, syndication, and Mastodon migration.",
   "keywords": [
     "indiekit",