Bring Micropub endpoint closer to the spec

- Detect form-encoded action=... requests, so form-encoded updates work
  and unhandled actions are no longer created as notes
- Default to h-entry when no type is given
- Read form-encoded photos from `photo` rather than `photos`
- Pass `category` through EntryData so bookmark tags are saved
- Accept single values for form-encoded multi-value properties
- Return 403 for insufficient_scope and 401 for invalid tokens
- Return 400 invalid_request for unsupported post types, update
  operations and models instead of reporting them as 500s

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/Http/Requests/MicropubRequest.php

@@ -15,25 +15,36 @@ class MicropubRequest extends FormRequest
         ];
     }
 
+    /**
+     * Determine the request type: the action (e.g. "update") if one is given,
+     * otherwise the microformat type without its "h-" prefix. Per the spec, a
+     * request with no type is treated as an h-entry.
+     */
     public function getType(): ?string
     {
         if ($this->isJson()) {
             $data = $this->json()->all();
 
-            if (isset($data['action']) && $data['action'] === 'update') {
-                return 'update';
+            if (isset($data['action']) && is_string($data['action'])) {
+                return $data['action'];
             }
 
             if (isset($data['type']) && is_array($data['type'])) {
                 $type = current($data['type']);
-                if (str_starts_with($type, 'h-')) {
+                if (is_string($type) && str_starts_with($type, 'h-')) {
                     return substr($type, 2);
                 }
+
+                return null;
             }
 
-            return null;
+            return 'entry';
         }
 
-        return $this->input('h') ?: null;
+        if ($this->filled('action')) {
+            return $this->input('action');
+        }
+
+        return $this->input('h') ?: 'entry';
     }
 }