As much as possible. The atproto libs aren't themselves consistent about this.

* lexicon: add sh.tangled.knot.policy

* i ran lexgen

* i ran nix fmt

---------

Co-authored-by: Akshay <nerdy@peppe.rs>

use custom roundtripper for hmac signing

full registration flow works now

When the knot is initialized, the h.init channel is closed signalling
the Jetstream watcher to begin, with the owner DID in filter. There's no
null filter so starting it without any DIDs will give us events for all
DIDs. /init also checks if h.knotInitialized is true, and will 409
Conflict if /init is called again.

PUT /user is similar, but will only trigger a call to UpdateDids.

idk how this came back

- new table tracks access levels between each DID and a repo
- creators of a repo are owners by default
- newly added members are writers by default
- introduces AccessLevel middleware to mask routes based on level

we can start clicking links and stuff now

So handles are now purely cosmetic and are resolved to DIDs in the middleware.
auth.ResolveIdent seems to add a lot of latency, so we cache the resolved ident
for 24 hours. It's still not as perfomant but we can come back to this later.