Show studios' and associations' Bluesky accounts

[engleek]

Part of #161: the organization half. Profiles follow once #157 adds Bluesky sign-in, and they'll reuse the person's handle from there, so the issue stays open.

Change

• Data: an optional entity.bsky_handle (migration 20261004120000_org_bluesky_handle).
• Form: a "Bluesky handle" field on the org form, used by create and edit.
• Normalising: what people type is cleaned up first. @Studio.bsky.social and https://bsky.app/profile/studio.bsky.social both become studio.bsky.social.
• Checking: on save, the handle is checked with Bluesky's public com.atproto.identity.resolveHandle (no sign-in needed). A malformed or unknown handle is refused with "No Bluesky account is called …" (or "… isn't a Bluesky handle"), shown as the usual error toast. On edit, the check runs before the update, so the toast says why.
• Display: the org page shows a Bluesky link (bsky.app/profile/<handle>) with the Bluesky icon, next to the website. I checked it in the browser.
• Configurable API: BLUESKY_API (default https://public.api.bsky.app), so tests don't depend on Bluesky.

Tests

• Unit: normalisation (@, case, profile URLs, empty input). The check covers empty → null, a resolving handle, and malformed or unknown → a readable error. Its assumptions match the real API, which returns 200 with a DID, or 400 "Unable to resolve handle".
• e2e: through the real create form, against a local stand-in for Bluesky's API. An unknown handle is refused with its message; @Sky-Studio.bsky.social is saved as sky-studio.bsky.social and linked from the org page.
• Locally: 53 e2e and 84 unit and story tests pass. The one failure was the polar-latitude map flake that Keep seeded places away from the poles #243 fixes.

Conflicts to expect: playwright.config.js (#245 also adds a test env var) and prisma/schema.prisma (#241). They're small; I'll rebuild whichever goes second.

🤖 Generated with Claude Code

[engleek]

Superseded by #249, which merged this change into main.