fix(backend): harden security and speed up feeds and article API

Security:
- WebSocket events are routed to their owner only (no cross-user leak);
  hub close is idempotent (fixes double-close panic), adds ping/pong and
  write deadlines.
- Session tokens stored as SHA-256 (migration 008 keeps sessions valid);
  single-query auth middleware puts the user in the request context.
- Client IP only trusts X-Forwarded-For from TRUSTED_PROXIES; rate limiter
  map is bounded; per-user limit on AI summaries.
- Argon2id at OWASP minimum with a concurrency cap; constant-time login
  for unknown emails; atomic first-admin bootstrap; REGISTRATION_ENABLED.
- CSP/HSTS/COOP headers, same-origin guard on mutations, body size limits,
  wider SSRF denylist, bounded feed/page/AI response reads, generic errors.
- Upgrade chi, pgx, x/net, x/text, x/crypto (known CVEs); commit go.sum.

Performance:
- List endpoints return a plain-text excerpt and reading time instead of
  full HTML; content is sanitized once at ingest (legacy rows backfilled).
- Keyset pagination on (sort_at, id) with matching partial indexes;
  redundant indexes dropped (migration 007).
- Fetcher: bounded worker pool, conditional GET (ETag/Last-Modified),
  exponential backoff, dedupe before insert, column-safe truncation,
  retention-aware ingest, per-user refresh coalescing.
- Read/favorite/read-all are single ownership-scoped statements.
- gzip compression, immutable caching for hashed assets, path-safe SPA
  handler, server timeouts; expired sessions purged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/handler/middleware_test.go

@@ -0,0 +1,38 @@
+package handler
+
+import (
+	"net/http/httptest"
+	"testing"
+)
+
+func TestGetClientIPIgnoresSpoofedHeadersWithoutTrustedProxy(t *testing.T) {
+	trustedProxies = nil
+	r := httptest.NewRequest("POST", "/api/v1/auth/login", nil)
+	r.RemoteAddr = "203.0.113.7:5555"
+	r.Header.Set("X-Forwarded-For", "1.2.3.4")
+	if got := getClientIP(r); got != "203.0.113.7" {
+		t.Fatalf("got %q, want peer address", got)
+	}
+}
+
+func TestGetClientIPUsesRightmostUntrustedHop(t *testing.T) {
+	trustedProxies = parsePrefixes("10.0.0.0/8")
+	defer func() { trustedProxies = nil }()
+	r := httptest.NewRequest("POST", "/", nil)
+	r.RemoteAddr = "10.0.0.2:443"
+	r.Header.Set("X-Forwarded-For", "6.6.6.6, 198.51.100.9, 10.0.0.3")
+	if got := getClientIP(r); got != "198.51.100.9" {
+		t.Fatalf("got %q, want 198.51.100.9", got)
+	}
+}
+
+func TestSameOriginGuard(t *testing.T) {
+	h := SameOriginGuard(nil)
+	r := httptest.NewRequest("POST", "http://reader.example/api/v1/articles/read-all", nil)
+	r.Header.Set("Sec-Fetch-Site", "cross-site")
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, r)
+	if w.Code != 403 {
+		t.Fatalf("cross-site POST got %d, want 403", w.Code)
+	}
+}