h-feed, h-card and h-entry

fix #361 with rich OEmbed display via iframe, fix #237 by hiding sensitive
content behind a spoiler on public pages

for avatars/headers, resize avatars down to 120x120 instead of 300x300. Set cache headers on S3 stuff, also
make it private (aka only accessible via expiring links to prevent hotlinking)

as well as formatting of content

adding attachments display to static views

simplify FanOutOnWriteService, add /api/accounts/lookup method