docs: Standardize all IndieAuth spec references to W3C URL

- Updated 42 references from indieauth.spec.indieweb.org to www.w3.org/TR/indieauth
- Ensures consistency across all documentation
- Points to the authoritative W3C specification
- No functional changes, documentation update only

Generated with Claude Code

Co-Authored-By: Claude <noreply@anthropic.com>

docs/decisions/ADR-017-oauth-client-metadata-document.md

@@ -162,7 +162,7 @@ def oauth_client_metadata():
     Returns JSON metadata about this IndieAuth client for authorization
     server discovery. Required by IndieAuth specification section 4.2.
 
-    See: https://indieauth.spec.indieweb.org/#client-information-discovery
+    See: https://www.w3.org/TR/indieauth/#client-information-discovery
     """
     metadata = {
         'issuer': current_app.config['SITE_URL'],
@@ -468,7 +468,7 @@ Assume IndieLogin.com has a bug and wait for them to fix it.
 ## References
 
 ### Specifications
-- [IndieAuth Specification](https://indieauth.spec.indieweb.org/)
+- [IndieAuth Specification](https://www.w3.org/TR/indieauth/)
 - [OAuth Client ID Metadata Document](https://www.ietf.org/archive/id/draft-parecki-oauth-client-id-metadata-document-00.html)
 - [RFC 7591 - OAuth 2.0 Dynamic Client Registration](https://www.rfc-editor.org/rfc/rfc7591.html)
 - [RFC 3986 - URI Generic Syntax](https://www.rfc-editor.org/rfc/rfc3986)