atproto: verify noisebridge.net handle via DNS TXT record

[mcint]

Verify the noisebridge.net atproto/Bluesky handle via a DNS TXT record instead of the m3/caddy HTTP handler.

Change

Add to the noisebridge.net zone:

_atproto  IN  TXT  "did=did:plc:4fn5ffs6txnxxozezxio3v7o"

and remove the Caddy handle /.well-known/atproto-did block, along with the now-unused noisebridge_atproto_did var and its vault entry. SOA serial bumped.

Also it seems odd to store public attestation values encrypted in the vault—in principle, a reverse linkability argument, but not here.

Why

We want a validated domain handle on bsky, or rather in the atproto ecosystem

• https://bsky.app/profile/did:plc:4fn5ffs6txnxxozezxio3v7o - did when validation absent
• https://bsky.app/profile/noisebridge.net - when validated again

The DNS TXT method is the atproto-preferred mechanism, avoids a configuration complexity & drift in Caddy, and keeps the (non-secret) DID in the public zone file in plaintext — no vault entry needed.

I do plan to propose a later PR for HTTP and DNS monitoring, so we catch breaks on deploy.

Why not HTTP again

I think atproto validation expects that /.well-known/atproto-did gets served a 200 from noisebridge.net, and not a 302 to www.noisebridge.net with 200 there. www (in browser) is also blocked by anubis—in any case there's complexity, and configuration drift there.

The bare redir https://www.noisebridge.net{uri} in the noisebridge.net Caddy site shadows the handle /.well-known/atproto-did block (Caddy directive ordering), so the HTTP method silently 302-redirected that path to the wiki and never served the DID:

$ curl -sI https://noisebridge.net/.well-known/atproto-did
HTTP/2 302
location: https://www.noisebridge.net/.well-known/atproto-did

Scope

I'm proposing a DNS change. I'd also drafted, with claude, a deploy-time HTTP- & DNS-verification monitoring machinery originally bundled here, but I'm deferring it to a separate, reframed PR (general DNS + HTTP-probe monitoring, not atproto-specific). That WIP is preserved on the atproto-handle-dns-draft-wip branch.