fix(federation): wire baseUrl through createFedifyMiddleware to fromExpressRequest

The function was called with publicationUrl as 3rd arg (ap-base-url patch)
but never accepted it — Fedify saw localhost:3000 instead of blog.giersig.eu,
causing webfinger hostname check to fail and return onNotFound → next() →
indieauth.authenticate() → 302 redirect for all public federation endpoints.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

lib/federation-bridge.js

@@ -143,7 +143,7 @@ async function sendFedifyResponse(res, response, request) {
  * @param {Function} contextDataFactory - (req) => contextData
  * @returns {import("express").RequestHandler}
  */
-export function createFedifyMiddleware(federation, contextDataFactory) {
+export function createFedifyMiddleware(federation, contextDataFactory, baseUrl) { // ap-base-url patch
   return async (req, res, next) => {
     try {
       // Buffer application/activity+json and ld+json request bodies ourselves —
@@ -180,7 +180,7 @@ export function createFedifyMiddleware(federation, contextDataFactory) {
         return res.status(200).end();
       }
 
-      const request = fromExpressRequest(req);
+      const request = fromExpressRequest(req, baseUrl); // ap-base-url patch
       const contextData = await Promise.resolve(contextDataFactory(req));
 
       let notFound = false;