Multi-tenant WebFinger server (RFC 7033) with ACME-style domain onboarding, scoped service token authorization, in-memory cache backed by SQLite, and server-rendered management UI.