Add IndieWeb collaboration: indieweb2-bastion integration

New: INDIEWEB-COLLABORATION.md
- Three-layer security model (bastion/aegis/sanctify)
- Proposed indieweb2-bastion enhancements:
  - Nickel contracts for Micropub/Webmention/IndieAuth
  - Webmention source validation at ingress
  - Micropub request validation
  - IndieAuth token introspection cache
  - SurrealDB provenance schema for IndieWeb events
- Integration patterns with php-aegis (header passthrough)
- sanctify-php IndieWeb-aware analysis
- Issue template for indieweb2-bastion repository
- Lessons exchanged between projects

Key insight: indieweb2-bastion handles infrastructure-level
protection, php-aegis handles application-level security.
Combined = defense in depth for IndieWeb protocols.

Author: claude

docs/IMPLEMENTATION-TRACKER.md

@@ -9,6 +9,7 @@
 | Standalone Requirements | ✅ Complete | See STANDALONE.md |
 | Target Audience | ✅ Complete | See TARGET-AUDIENCE.md |
 | Upstream Issues | ✅ Complete | See UPSTREAM-ISSUES.md |
+| IndieWeb Collaboration | ✅ Complete | See INDIEWEB-COLLABORATION.md |
 | Binary Releases | 🔲 Not Started | **BLOCKER** - Tool cannot run without this |
 | Composer Plugin | 🔲 Not Started | **CRITICAL** - Enable `composer require` |
 | Docker Container | 🔲 Not Started | **HIGH** - Fallback for binary issues |