fix(web-app-bluesky): raise pds past the handle check that measures the wrong end

Both Bluesky#1 rows of run 36651124458 die on
`tasks/04_native_admin.yml:13` with

    {"error":"InvalidHandle","message":"Handle too long"}

byte-identically in compose/clearnet and swarm/tor, because the failing value
is a pure function of the domain and never touches the network path.

`vars/main.yml:41` builds `kc-<administrator>.<handle domain>` and
`vars/main.yml:32` maps a `.test` suffix to `.app`. On main
`INFINITO_DOMAIN=infinito.test` yields `kc-administrator.infinito.app`, 29
characters. This branch sets `main.infinito.test`, which yields
`kc-administrator.main.infinito.app`, 34. pds 0.4.0 compares the WHOLE handle
against 30 instead of the part in front of the domain, so main passed with a
single character to spare and the five characters this branch added tipped it
over. Read from the pinned image itself, 0.4.21 has

    if (front.length > 18) throw InvalidRequestError('Handle too long')

and `kc-administrator` is 16, which now holds for any domain length.

Shortening the handle is not available: with a 17-character domain the limit
leaves 12 characters for the local part and `administrator` alone is 13.

0.4.21 is not a preference but the floor. Every tag from 0.4.13 to 0.4.20 was
probed and none is published, so it is the lowest tag above the broken range.
`/app/package.json` in that image pins `@atproto/pds` to 0.4.21, so the image
tag and the package version track each other and the jump is as small as
upstream allows.

The version move also renames one key we set. Comparing the 65 `PDS_` keys
0.4.21 reads against the 19 `templates/env.j2` writes leaves exactly one
unmatched: `PDS_ADMIN_EMAIL` appears nowhere in the image, and the value is
read from `PDS_CONTACT_EMAIL_ADDRESS` instead. Without this the administrator
address would have gone missing silently. After the rename no key we set is
unknown to the image.

Worth stating beyond CI: `infinito.nexus` is not in the suffix map, so
production builds `kc-administrator.infinito.nexus`, 31 characters. On pds
0.4.0 that fails too. The defect was latent for any primary domain longer than
13 characters, and the env change only exposed it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/web-app-bluesky/meta/services.yml

@@ -75,7 +75,7 @@ view:
   pids_limit: 256
 pds:
   image: ghcr.io/bluesky-social/pds
-  version: 0.4.0
+  version: 0.4.21
   min_storage: 290MB
   cpus: "1.0"
   mem_reservation: 1g

roles/web-app-bluesky/templates/env.j2

@@ -15,7 +15,7 @@ PDS_SERVICE_DID=did:web:{{ BLUESKY_API_DOMAIN }}
 
 {% set email = lookup('email', application_id) %}
 {% if email.enabled | bool %}
-PDS_ADMIN_EMAIL={{ BLUESKY_ADMIN_EMAIL }}
+PDS_CONTACT_EMAIL_ADDRESS={{ BLUESKY_ADMIN_EMAIL }}
 PDS_EMAIL_SMTP_URL=smtps://{{ email.username }}:{{ email.password }}@{{ email.host }}:{{ email.port }}/
 PDS_EMAIL_FROM_ADDRESS={{ email['from'] }}
 {% endif %}