fix(backend): harden security and speed up feeds and article API

Security:
- WebSocket events are routed to their owner only (no cross-user leak);
  hub close is idempotent (fixes double-close panic), adds ping/pong and
  write deadlines.
- Session tokens stored as SHA-256 (migration 008 keeps sessions valid);
  single-query auth middleware puts the user in the request context.
- Client IP only trusts X-Forwarded-For from TRUSTED_PROXIES; rate limiter
  map is bounded; per-user limit on AI summaries.
- Argon2id at OWASP minimum with a concurrency cap; constant-time login
  for unknown emails; atomic first-admin bootstrap; REGISTRATION_ENABLED.
- CSP/HSTS/COOP headers, same-origin guard on mutations, body size limits,
  wider SSRF denylist, bounded feed/page/AI response reads, generic errors.
- Upgrade chi, pgx, x/net, x/text, x/crypto (known CVEs); commit go.sum.

Performance:
- List endpoints return a plain-text excerpt and reading time instead of
  full HTML; content is sanitized once at ingest (legacy rows backfilled).
- Keyset pagination on (sort_at, id) with matching partial indexes;
  redundant indexes dropped (migration 007).
- Fetcher: bounded worker pool, conditional GET (ETag/Last-Modified),
  exponential backoff, dedupe before insert, column-safe truncation,
  retention-aware ingest, per-user refresh coalescing.
- Read/favorite/read-all are single ownership-scoped statements.
- gzip compression, immutable caching for hashed assets, path-safe SPA
  handler, server timeouts; expired sessions purged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/handler/admin.go

@@ -44,11 +44,9 @@ func (h *AdminHandler) DeleteUser(w http.ResponseWriter, r *http.Request) {
 
 	// Prevent an admin from deleting their own account (lockout / accidental
 	// self-removal). The AdminOnly middleware has already verified admin rights.
-	if cookie, cErr := r.Cookie("session_id"); cErr == nil {
-		if current, _ := h.authService.GetUserByToken(cookie.Value); current != nil && current.ID == userID {
-			respondError(w, http.StatusForbidden, "You cannot delete your own account")
-			return
-		}
+	if current := currentUser(r); current != nil && current.ID == userID {
+		respondError(w, http.StatusForbidden, "You cannot delete your own account")
+		return
 	}
 
 	// Logic to delete user and all associated data
@@ -60,21 +58,15 @@ func (h *AdminHandler) DeleteUser(w http.ResponseWriter, r *http.Request) {
 	respondJSON(w, http.StatusOK, map[string]string{"message": "User deleted successfully"})
 }
 
-// AdminOnly middleware restricts access to admins.
+// AdminOnly middleware restricts access to admins. Must run after RequireAuth.
 func (h *AdminHandler) AdminOnly(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		cookie, err := r.Cookie("session_id")
-		if err != nil {
+		user := currentUser(r)
+		if user == nil {
 			respondError(w, http.StatusUnauthorized, "Not authenticated")
 			return
 		}
 
-		user, err := h.authService.GetUserByToken(cookie.Value)
-		if err != nil || user == nil {
-			respondError(w, http.StatusUnauthorized, "Invalid session")
-			return
-		}
-
 		if user.Role != domain.RoleAdmin {
 			respondError(w, http.StatusForbidden, "Admin access required")
 			return