Serialize and serve the full range of saved activity resources #153

Part of #138. Replace the StoredCreate/toCreate() assumption with serialization and federation reads that cover the document contract from #149.

The current activity dispatcher is registered for Create at /ap/creates/{id}. Generalizing types must preserve existing resource identities while making newly saved activity types retrievable at their own IRIs.

Scope

• Serialize saved activities and supported object values according to their actual types, including nested activities, IRI references, type-specific properties, and extensions. Do not reconstruct every document as a Create with a Note-shaped object.
• Serve each local saved activity through an appropriate dispatcher and content-negotiated ActivityStreams response. Retain existing Create and object IRIs; define how new type routes or a general route are assigned without changing an existing ID.
• Use a saved activity's historical document rather than the current content of an object it once embedded. Preserve IRI references as references unless an explicitly documented serving rule requires otherwise.
• Apply existing instance-host rules, deletion behavior, and visibility checks to all newly supported types. Strip blind addressing from public/federated output, including nested documents where it would otherwise leak, while keeping protected local snapshots intact.
• Provide the common serialization interface that Send test activities and retry failed deliveries #145 can use for outgoing payloads. Keep serialization independent of network delivery and do not introduce a second sender.

Completion criteria

• Fixtures for every activity type preserve the agreed semantic values through serialization. Test Undo(Like), Accept(Follow), collection targets, and intransitive activities through actual federation reads as well as serializer calls.
• Existing saved IRIs remain usable. Requests on another instance's authority cannot retrieve a local resource by guessing its identifier.
• Changing a current object does not rewrite a past activity response. Unknown extension properties survive serialization within the agreed support policy.
• Blind recipients and private resources remain protected across direct resource fetches, nested documents, and deletion responses. Existing Create serving tests remain green.

Boundaries and starting points

Collection management endpoints belong to #142, sending and dispatch snapshots to #145, and workspace GraphQL reads to #154. #155 adds the Question-specific adapter and fixtures using the general interface established here.

Inspect packages/federation/src/object.ts, packages/federation/src/object-dispatchers.ts, packages/federation/src/visibility.ts, and packages/federation/src/origin.ts. Any host-composition changes must remain in the existing origin layer.