There are web frontends available where you can sign into your instance, just like you so with a mobile app. For example https://pinafore.social/
Mastodon is an ActivityPub client.
If you write a new application from scratch that also uses the ActivityPub protocol, like Pinafore, it is not a frontend for Mastodon. It is another ActivityPub client, right?
You register with a given Mastodon instance which speaks ActivityPub to other servers which may or may not be Mastodon instances as well.
Now your home Mastodon instance also serves a React frontend which is technically acting as an OAuth2 client that speaks to the backend via REST APIs, compared to say: Server-side rendered HTML
Similarly, mobile apps connecting to your preferred instance are also OAuth2 clients.
In that sense, you can use a different frontend to speak directly to the REST APIs offered by your Mastodon instance of choice.
This all being one level above ActivityPub itself of course.
In a literal sense, your username and password / authentication tokens live on that server and is unknowable to other servers.
You might imagine that if there was federation of accounts than any random user could simply eat up passwords/password hashes.
That said, you can presumably use any client as long as it uses the APIs of the home instance.
You can browse other instances and do a remote follow however where that instance calls back to your home instance to initiate the follow action but it requires you telling the remote server what your full ID is (@Timja@home.instance) so it knows where to call back to
I think this is where the confusion stems from, the way I understand it:
Mastodon is a server that implements the federation part of the ActivityPub protocol to exchange objects with compatible server software. It has functionality which exceeds the ActivityPub client-to-server protocol, which it doesn't implement, and opts to instead have its own client API. [1]
So if you were to write an application using the ActivityPub C2S protocol, you could not directly communicate with a Mastodon server, but could interact with objects created by a Mastodon server through another server software implementing both the federation and C2S protocol.
So in that sense they are Mastodon frontends because they probably use the Mastodon specific API instead of the ActivityPub C2S protocol.
Here is for example a list of implementations which includes whether the client-to-server protocol is supported [2].
[1]: https://github.com/mastodon/mastodon/issues/10520 [2]: https://activitypub.rocks/implementation-report/
Maybe we could call the Mastodon server software an "ActivitPub node" to make it clearer?
So Pinafore is not an ActivityPub node, but instead it is something that talks to a Mastodon server?