big scary refactor. sync enable_bluesky_posts with captain record. implement oauth logout handler. implement crew assignment to hold. this caused a lot of circular dependencies and needed to move functions around in order to fix

docs/BLUESKY_MANIFEST_POSTS.md

@@ -694,7 +694,7 @@ func TestHandleNotifyManifest(t *testing.T) {
 ```bash
 # Enable/disable Bluesky manifest posting (default: false)
 # When enabled, hold will create Bluesky posts when users push images
-# Can be overridden per-hold via captain record's enableManifestPosts field
+# Synced to captain record's enableBlueskyPosts field on startup
 HOLD_BLUESKY_POSTS_ENABLED=false
 ```
 
@@ -702,20 +702,21 @@ HOLD_BLUESKY_POSTS_ENABLED=false
 
 ### Feature Flags
 
-**Captain Record Override:**
-The hold's captain record includes an `enableManifestPosts` field that overrides the environment variable:
+**Captain Record Sync:**
+The hold's captain record includes an `enableBlueskyPosts` field that is synchronized with the environment variable on startup:
 
 ```go
 type CaptainRecord struct {
     // ... other fields ...
-    EnableManifestPosts bool `json:"enableManifestPosts" cborgen:"enableManifestPosts"`
+    EnableBlueskyPosts bool `json:"enableBlueskyPosts" cborgen:"enableBlueskyPosts"`
 }
 ```
 
-**Precedence (highest to lowest):**
-1. Captain record `enableManifestPosts` field (if set)
-2. `HOLD_BLUESKY_POSTS_ENABLED` environment variable
-3. Default: `false` (opt-in feature)
+**How it works:**
+1. On startup, Bootstrap reads `HOLD_BLUESKY_POSTS_ENABLED` environment variable
+2. Creates or updates the captain record to match the env var setting
+3. At runtime, the code reads from the captain record (which reflects the env var)
+4. To change the setting, update the env var and restart the hold
 
 **Rationale:**
 - Default off for backward compatibility and privacy