Address review feedback on smoke test harness

 -  Fix scheme mismatch in fallback actor URI construction: actorId
    now uses the same scheme variable as inboxId instead of hardcoding
    https://
 -  Replace try/catch with empty catch blocks in lookupFedifyAccount()
    with direct fetch + res.ok checks, letting real network errors
    propagate naturally
 -  Add 10-second fetch timeout to WebFinger and actor document
    resolution to prevent indefinite hangs

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: sij411

test/smoke/harness/backdoor.ts

@@ -12,6 +12,7 @@ function json(data: unknown, status = 200): Response {
 // Resolve a handle (user@domain) to the correct actor URI and inbox URL
 // via WebFinger + actor document fetch.  Falls back to the Mastodon URL
 // convention (/users/{username}) when WebFinger is unavailable.
+const FETCH_TIMEOUT_MS = 10_000;
 const recipientCache = new Map<string, { inboxId: URL; actorId: URL }>();
 
 async function parseRecipient(
@@ -31,6 +32,7 @@ async function parseRecipient(
     }`;
     const wfRes = await fetch(wfUrl, {
       headers: { Accept: "application/jrd+json" },
+      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
     });
     if (wfRes.ok) {
       const wf = await wfRes.json() as {
@@ -44,6 +46,7 @@ async function parseRecipient(
         // Fetch the actor document to discover the inbox URL
         const actorRes = await fetch(self.href, {
           headers: { Accept: "application/activity+json" },
+          signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
         });
         if (actorRes.ok) {
           const actor = await actorRes.json() as { inbox?: string };
@@ -61,7 +64,7 @@ async function parseRecipient(
 
   // Fallback: construct URLs using Mastodon convention
   const inboxId = new URL(`${scheme}://${domain}/users/${user}/inbox`);
-  const actorId = new URL(`https://${domain}/users/${user}`);
+  const actorId = new URL(`${scheme}://${domain}/users/${user}`);
   const result = { inboxId, actorId };
   recipientCache.set(handle, result);
   return result;

test/smoke/orchestrator.ts

@@ -156,50 +156,47 @@ async function lookupFedifyAccount(): Promise<string> {
   const handle = `testuser@${HARNESS_HOST}`;
 
   const searchResult = await poll("Fedify user resolvable", async () => {
+    const authHeaders = { Authorization: `Bearer ${SERVER_TOKEN}` };
+
     // Try /api/v1/accounts/search (Mastodon standard).
-    // Fall back to /api/v1/accounts/lookup (exact match, supported by Sharkey)
-    // if search returns 404.
-    try {
-      const results = await serverGet(
-        `/api/v1/accounts/search?q=${
-          encodeURIComponent(`@${handle}`)
-        }&resolve=true&limit=5`,
-      ) as RemoteAccount[];
+    const searchRes = await fetch(
+      `${SERVER_URL}/api/v1/accounts/search?q=${
+        encodeURIComponent(`@${handle}`)
+      }&resolve=true&limit=5`,
+      { headers: authHeaders },
+    );
+    if (searchRes.ok) {
+      const results = await searchRes.json() as RemoteAccount[];
       const match = results?.find((a) =>
         a.acct === handle || a.acct === `@${handle}`
       );
       if (match) return match;
-    } catch {
-      // Search endpoint may return 404 on some servers (e.g. Sharkey);
-      // fall through to the lookup endpoint.
     }
 
-    try {
-      const account = await serverGet(
-        `/api/v1/accounts/lookup?acct=${encodeURIComponent(handle)}`,
-      ) as RemoteAccount;
+    // Fall back to /api/v1/accounts/lookup (exact match, supported by
+    // Sharkey) if search didn't return a match.
+    const lookupRes = await fetch(
+      `${SERVER_URL}/api/v1/accounts/lookup?acct=${encodeURIComponent(handle)}`,
+      { headers: authHeaders },
+    );
+    if (lookupRes.ok) {
+      const account = await lookupRes.json() as RemoteAccount;
       if (account?.id) return account;
-    } catch {
-      // lookup also failed
     }
 
     // Misskey-native fallback: POST /api/users/show with username + host.
     // Sharkey's Mastodon-compat search/lookup endpoints have bugs with
     // remote users, but the native API works reliably.  The returned id
     // is the same internal ID used by the Mastodon-compat layer.
-    try {
-      const [user, host] = handle.split("@");
-      const res = await fetch(`${SERVER_URL}/api/users/show`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ username: user, host }),
-      });
-      if (res.ok) {
-        const data = await res.json() as { id?: string };
-        if (data?.id) return { id: data.id, acct: handle };
-      }
-    } catch {
-      // Not a Misskey-family server
+    const [user, host] = handle.split("@");
+    const misskeyRes = await fetch(`${SERVER_URL}/api/users/show`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ username: user, host }),
+    });
+    if (misskeyRes.ok) {
+      const data = await misskeyRes.json() as { id?: string };
+      if (data?.id) return { id: data.id, acct: handle };
     }
 
     return null;