fix(backend): harden security and speed up feeds and article API

Security:
- WebSocket events are routed to their owner only (no cross-user leak);
  hub close is idempotent (fixes double-close panic), adds ping/pong and
  write deadlines.
- Session tokens stored as SHA-256 (migration 008 keeps sessions valid);
  single-query auth middleware puts the user in the request context.
- Client IP only trusts X-Forwarded-For from TRUSTED_PROXIES; rate limiter
  map is bounded; per-user limit on AI summaries.
- Argon2id at OWASP minimum with a concurrency cap; constant-time login
  for unknown emails; atomic first-admin bootstrap; REGISTRATION_ENABLED.
- CSP/HSTS/COOP headers, same-origin guard on mutations, body size limits,
  wider SSRF denylist, bounded feed/page/AI response reads, generic errors.
- Upgrade chi, pgx, x/net, x/text, x/crypto (known CVEs); commit go.sum.

Performance:
- List endpoints return a plain-text excerpt and reading time instead of
  full HTML; content is sanitized once at ingest (legacy rows backfilled).
- Keyset pagination on (sort_at, id) with matching partial indexes;
  redundant indexes dropped (migration 007).
- Fetcher: bounded worker pool, conditional GET (ETag/Last-Modified),
  exponential backoff, dedupe before insert, column-safe truncation,
  retention-aware ingest, per-user refresh coalescing.
- Read/favorite/read-all are single ownership-scoped statements.
- gzip compression, immutable caching for hashed assets, path-safe SPA
  handler, server timeouts; expired sessions purged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/utils/extractor.go

@@ -3,6 +3,7 @@ package utils
 import (
 	"context"
 	"fmt"
+	"io"
 	"net/http"
 	"strings"
 	"time"
@@ -10,6 +11,9 @@ import (
 	"github.com/PuerkitoBio/goquery"
 )
 
+// maxPageBytes bounds how much of a remote page is read.
+const maxPageBytes = 5 << 20
+
 // ContentExtractor extracts the main text content from a web page.
 type ContentExtractor struct {
 	client *http.Client
@@ -52,7 +56,10 @@ func (e *ContentExtractor) Extract(ctx context.Context, url string) (string, err
 		return "", fmt.Errorf("unexpected status code: %d", resp.StatusCode)
 	}
 
-	doc, err := goquery.NewDocumentFromReader(resp.Body)
+	if resp.ContentLength > maxPageBytes {
+		return "", fmt.Errorf("page too large")
+	}
+	doc, err := goquery.NewDocumentFromReader(io.LimitReader(resp.Body, maxPageBytes))
 	if err != nil {
 		return "", fmt.Errorf("parsing HTML: %w", err)
 	}
@@ -102,9 +109,7 @@ func (e *ContentExtractor) Extract(ctx context.Context, url string) (string, err
 	}
 
 	// Limit to 10000 characters to avoid huge payloads to AI
-	if len(content) > 10000 {
-		content = content[:10000]
-	}
+	content = TruncateRunes(content, 10000)
 
 	return content, nil
 }