fix(social): harden Mastodon status publishing

[davethediver1010-cmd]

Summary

• Replace the Mastodon stub with real status publishing through /api/v1/statuses.
• Normalize instance URLs and derive the per-instance token key.
• Return native status IDs, URLs, and timestamps from the Mastodon response.
• Add social contract coverage plus success, API-error, and unsupported-media tests.

Verification

• pnpm exec vitest run packages/social/mastodon/src/index.test.ts
• pnpm --filter @profullstack/sh1pt-social-mastodon typecheck

[ralyodio]

please rebase: already completed: #62

[davethediver1010-cmd]

Rebased the branch on current master and narrowed the change to incremental Mastodon hardening after #62. GitHub would not let this closed PR reopen after the force-push, so I opened the clean replacement here: #65