fix(backend): harden security and speed up feeds and article API

Security:
- WebSocket events are routed to their owner only (no cross-user leak);
  hub close is idempotent (fixes double-close panic), adds ping/pong and
  write deadlines.
- Session tokens stored as SHA-256 (migration 008 keeps sessions valid);
  single-query auth middleware puts the user in the request context.
- Client IP only trusts X-Forwarded-For from TRUSTED_PROXIES; rate limiter
  map is bounded; per-user limit on AI summaries.
- Argon2id at OWASP minimum with a concurrency cap; constant-time login
  for unknown emails; atomic first-admin bootstrap; REGISTRATION_ENABLED.
- CSP/HSTS/COOP headers, same-origin guard on mutations, body size limits,
  wider SSRF denylist, bounded feed/page/AI response reads, generic errors.
- Upgrade chi, pgx, x/net, x/text, x/crypto (known CVEs); commit go.sum.

Performance:
- List endpoints return a plain-text excerpt and reading time instead of
  full HTML; content is sanitized once at ingest (legacy rows backfilled).
- Keyset pagination on (sort_at, id) with matching partial indexes;
  redundant indexes dropped (migration 007).
- Fetcher: bounded worker pool, conditional GET (ETag/Last-Modified),
  exponential backoff, dedupe before insert, column-safe truncation,
  retention-aware ingest, per-user refresh coalescing.
- Read/favorite/read-all are single ownership-scoped statements.
- gzip compression, immutable caching for hashed assets, path-safe SPA
  handler, server timeouts; expired sessions purged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/domain/feed.go

@@ -20,8 +20,29 @@ type Feed struct {
 	CreatedAt     time.Time  `json:"created_at"`
 	UpdatedAt     time.Time  `json:"updated_at"`
 
+	// Fetch state (HTTP conditional GET + error backoff); not exposed.
+	ETag         string     `json:"-"`
+	LastModified string     `json:"-"`
+	ErrorCount   int        `json:"-"`
+	NextFetchAt  *time.Time `json:"-"`
+
 	// Virtual fields (not in DB)
-	UnreadCount int `json:"unread_count,omitempty"`
+	UnreadCount int `json:"unread_count"`
+}
+
+// FetchResult is the outcome of one fetch attempt, persisted in one statement.
+type FetchResult struct {
+	FetchedAt    time.Time
+	NextFetchAt  time.Time
+	Error        string // empty on success
+	ErrorCount   int
+	ETag         string
+	LastModified string
+	// Metadata from the feed document; nil when the feed wasn't (re)parsed.
+	Title       *string
+	Description *string
+	SiteURL     *string
+	ImageURL    *string
 }
 
 // FeedRepository defines the interface for feed data access.
@@ -32,6 +53,7 @@ type FeedRepository interface {
 	GetByURL(userID uuid.UUID, url string) (*Feed, error)
 	Update(feed *Feed) error
 	Delete(id uuid.UUID) error
+	// GetFeedsToFetch returns feeds whose next fetch is due.
 	GetFeedsToFetch(limit int) ([]*Feed, error)
-	UpdateFetchStatus(id uuid.UUID, fetchedAt time.Time, fetchError string) error
+	SaveFetchResult(id uuid.UUID, res FetchResult) error
 }