feat(atproto): local handle resolution fallback in custom fetch

[tompscanlan]

Summary

• Extends createPlcFallbackFetch() to intercept .well-known/atproto-did requests for handles matching PDS_SERVICE_HANDLE_DOMAINS
• Tries canonical DNS/.well-known path first (3s timeout), falls back to local PDS com.atproto.identity.resolveHandle
• Fixes OAuth flows for custodial users with .pds.test handles in local Docker dev (no DNS for handle domain)
• Reads PDS_URL and PDS_SERVICE_HANDLE_DOMAINS from config in initializeOAuthClient()

How it works

fetch("https://bob-jones.pds.test/.well-known/atproto-did")
  → Step 1: Try normal DNS fetch (3s timeout) → fails (no DNS for .pds.test)
  → Step 2: Try PDS resolveHandle → returns did:plc:3asjfargakqdqezbcqnhqfdm
  → Return synthetic Response("did:plc:3asjfargakqdqezbcqnhqfdm")

In dev/prod where DNS works, the normal path succeeds and PDS is never called.

Test plan

• 28 unit tests passing (13 new handle resolution tests + 15 existing PLC fallback tests)
• Verify in local Docker with restored prod PDS backup
• Verify no regression in dev environment (DNS handles still resolve normally)