Add ActivityPub RSA key custody and signing oracle

[NotThatKindOfDrLiz]

Summary

Add per-user RSA-2048 ActivityPub key custody and an RSA-SHA256 HTTP-Signature signing oracle to Keycast for the ActivityPub gateway.

Motivation

The gateway needs Keycast to generate, store, expose, and use ActivityPub actor RSA keys without letting private keys leave Keycast. This must live alongside the existing Nostr signing path without changing Nostr behavior.

Acceptance Criteria

• Keycast can idempotently generate an RSA-2048 keypair per (tenant_id, user_pubkey).
• Private keys are encrypted at rest using the existing KeyManager.
• Public keys are exposed as SPKI PEM for ActivityPub actor documents.
• A service-token or UCAN-authenticated signing endpoint signs caller-provided HTTP Signature strings with RSA-SHA256.
• Tenant isolation and suspended-account checks are preserved.
• OpenAPI and tests cover the new endpoints and signing behavior.