fix(backend): harden security and speed up feeds and article API

Security:
- WebSocket events are routed to their owner only (no cross-user leak);
  hub close is idempotent (fixes double-close panic), adds ping/pong and
  write deadlines.
- Session tokens stored as SHA-256 (migration 008 keeps sessions valid);
  single-query auth middleware puts the user in the request context.
- Client IP only trusts X-Forwarded-For from TRUSTED_PROXIES; rate limiter
  map is bounded; per-user limit on AI summaries.
- Argon2id at OWASP minimum with a concurrency cap; constant-time login
  for unknown emails; atomic first-admin bootstrap; REGISTRATION_ENABLED.
- CSP/HSTS/COOP headers, same-origin guard on mutations, body size limits,
  wider SSRF denylist, bounded feed/page/AI response reads, generic errors.
- Upgrade chi, pgx, x/net, x/text, x/crypto (known CVEs); commit go.sum.

Performance:
- List endpoints return a plain-text excerpt and reading time instead of
  full HTML; content is sanitized once at ingest (legacy rows backfilled).
- Keyset pagination on (sort_at, id) with matching partial indexes;
  redundant indexes dropped (migration 007).
- Fetcher: bounded worker pool, conditional GET (ETag/Last-Modified),
  exponential backoff, dedupe before insert, column-safe truncation,
  retention-aware ingest, per-user refresh coalescing.
- Read/favorite/read-all are single ownership-scoped statements.
- gzip compression, immutable caching for hashed assets, path-safe SPA
  handler, server timeouts; expired sessions purged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/handler/auth.go

@@ -52,8 +52,12 @@ func (h *AuthHandler) Register(w http.ResponseWriter, r *http.Request) {
 			respondError(w, http.StatusBadRequest, "Invalid email format")
 		case errors.Is(err, service.ErrPasswordTooShort):
 			respondError(w, http.StatusBadRequest, "Password must be at least 8 characters")
+		case errors.Is(err, service.ErrPasswordTooLong):
+			respondError(w, http.StatusBadRequest, "Password is too long")
 		case errors.Is(err, service.ErrEmailAlreadyExists):
 			respondError(w, http.StatusConflict, "Email already registered")
+		case errors.Is(err, service.ErrRegistrationClosed):
+			respondError(w, http.StatusForbidden, "Registration is disabled on this instance")
 		default:
 			respondError(w, http.StatusInternalServerError, "Registration failed")
 		}
@@ -123,24 +127,9 @@ func (h *AuthHandler) Logout(w http.ResponseWriter, r *http.Request) {
 	respondJSON(w, http.StatusOK, map[string]string{"message": "Logged out successfully"})
 }
 
-// Me handles GET /api/v1/users/me
+// Me handles GET /api/v1/users/me (behind RequireAuth).
 func (h *AuthHandler) Me(w http.ResponseWriter, r *http.Request) {
-	cookie, err := r.Cookie("session_id")
-	if err != nil {
-		respondError(w, http.StatusUnauthorized, "Not authenticated")
-		return
-	}
-
-	user, err := h.authService.GetUserByToken(cookie.Value)
-	if err != nil {
-		respondError(w, http.StatusInternalServerError, "Failed to get user")
-		return
-	}
-	if user == nil {
-		respondError(w, http.StatusUnauthorized, "Session expired")
-		return
-	}
-
+	user := currentUser(r)
 	respondJSON(w, http.StatusOK, service.UserInfo{
 		ID:      user.ID,
 		Email:   user.Email,
@@ -148,31 +137,15 @@ func (h *AuthHandler) Me(w http.ResponseWriter, r *http.Request) {
 	})
 }
 
-// getClientIP extracts the client IP from the request.
-func getClientIP(r *http.Request) string {
-	// Check X-Forwarded-For header
-	forwarded := r.Header.Get("X-Forwarded-For")
-	if forwarded != "" {
-		// Take the first IP in the chain
-		parts := strings.Split(forwarded, ",")
-		return strings.TrimSpace(parts[0])
-	}
-
-	// Check X-Real-IP header
-	realIP := r.Header.Get("X-Real-IP")
-	if realIP != "" {
-		return realIP
-	}
-
-	// Fall back to RemoteAddr
-	return r.RemoteAddr
-}
-
 // respondJSON writes a JSON response.
 func respondJSON(w http.ResponseWriter, status int, data interface{}) {
-	w.Header().Set("Content-Type", "application/json")
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
 	w.WriteHeader(status)
-	json.NewEncoder(w).Encode(data)
+	enc := json.NewEncoder(w)
+	// Safe: served as application/json with nosniff; avoids inflating HTML
+	// content with \u003c escapes.
+	enc.SetEscapeHTML(false)
+	enc.Encode(data)
 }
 
 // respondError writes an error response.