Problem

WebFinger (/.well-known/webfinger) and OAuth (/oauth/authorize, /oauth/token) are currently registered inside activityPubPlugin, which only runs with --activitypub. This means:

• remoteStorage discovery doesn't work without --activitypub
• OAuth-based auth (for RS apps, third-party panes) requires --activitypub
• The WebFinger endpoint is tightly coupled to AP even though it serves multiple protocols

Proposed solution

Extract into two standalone plugins that are always on:

1. WebFinger plugin — /.well-known/webfinger with extensible link relations. AP, RS, and future protocols register their own links.
2. OAuth plugin — /oauth/authorize, /oauth/token. Shared by Mastodon clients, RS apps, and third-party panes.

The AP plugin would then just add its link relations to WebFinger rather than owning the endpoint.

Current workaround

Use --activitypub flag to enable RS discovery and OAuth.

Related

• PR remoteStorage protocol support #162 — remoteStorage protocol support
• Issue OAuth 2.0 authorize/token flow #160 — OAuth 2.0 layer
• Issue Feature: remoteStorage Protocol Support #106 — remoteStorage full plan