- TTL-cache DID/actor lookups (24h) under a dedicated mutex, with a
separate refresh lock so auth refreshes never fight the cache
- clamp zero/excessive limits (maxBskyFeedLimit, maxAuthorFeedPages)
and stop timeline pagination early once a bound or applimit is hit
- restrict feed URIs to http(s) and validate AT-URIs in GetPost
- derive the profile URL from the handle instead of the raw URI