feat: add setup did command to publish labeler identity

`cargo run --bin setup -- did` adds #atproto_label and #atproto_labeler to the
DID document via the PDS-signed PLC flow, prompting for the main password and
the emailed code. Splits setup into declare/did modules.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -1,4 +1,4 @@
-# cosocial cities labeler
+# Canadian Cities Labeler
 
 An atproto labeler that puts a Canadian city badge on accounts that ask for one over Bluesky DMs.
 
@@ -10,17 +10,6 @@ The labeler polls its DMs, matches the city against `data/cities.json`, and sign
 label (e.g. `halifax-ns`), negating any previous one. Labels are stored in SQLite and served over
 `com.atproto.label.subscribeLabels` and `queryLabels`.
 
-```
-src/
-  dms.rs       DM polling, onboarding, replies
-  cities.rs    city list and matching
-  labeler.rs   set_city: negate the old label, apply the new one
-  labels.rs    label signing
-  server.rs    queryLabels + subscribeLabels (axum, jacquard-axum)
-  db.rs        SQLite
-  bin/keygen.rs
-```
-
 Built on [jacquard](https://tangled.org/nonbinary.computer/jacquard) for atproto types and XRPC.
 
 ## Local test
@@ -39,3 +28,11 @@ DM it from a test account, then check
 
 Labels won't appear in the Bluesky app until the labeler is deployed publicly and its DID
 document has the `#atproto_label` key and `#atproto_labeler` service.
+
+## First time setup
+
+```sh
+cargo run --bin setup -- declare   # label definitions; gives the account a Subscribe button
+cargo run --bin setup -- did       # run after deploying; requires labeler account's main password + emailed code
+```
+