sécurité : correctifs XSS, SSRF, CSWSH, rate-limit et durcissement

- XSS stocké (critique) : sanitisation bluemonday sur tous les endpoints
  d'articles (List, ListByFeed, Favorites, Search, Get), pas seulement Get
- SSRF (élevé) : nouveau utils/safehttp.go (ValidateExternalURL + client durci
  via Dialer.Control, bloque IP privées/loopback/link-local/metadata,
  anti-DNS-rebinding et limite de redirections) appliqué à l'extracteur et au parser
- WebSocket CSWSH (élevé) : politique same-origin + override WS_ALLOWED_ORIGINS
- rate-limiting (moyen) : token-bucket en mémoire sur /auth/*
- token de session retiré du corps JSON (json:"-"), livré uniquement par le
  cookie HttpOnly
- cookie Secure correct derrière un reverse-proxy (X-Forwarded-Proto +
  override COOKIE_SECURE)
- admin : interdiction de supprimer son propre compte
- en-têtes de sécurité (nosniff, X-Frame-Options, Referrer-Policy,
  Permissions-Policy)

Note : backend non compilé localement (pas de toolchain Go) ; à valider via Docker.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/handler/article.go

@@ -37,6 +37,28 @@ func NewArticleHandler(articleRepo domain.ArticleRepository, feedService *servic
 	}
 }
 
+// sanitizeArticle cleans the user-facing HTML fields of a single article to
+// prevent stored XSS from malicious feeds. AISummary is rendered as plain text
+// by the client, so only Content and Summary need sanitization.
+func (h *ArticleHandler) sanitizeArticle(a *domain.Article) {
+	if a == nil {
+		return
+	}
+	if a.Content != "" {
+		a.Content = h.sanitizer.Sanitize(a.Content)
+	}
+	if a.Summary != "" {
+		a.Summary = h.sanitizer.Sanitize(a.Summary)
+	}
+}
+
+// sanitizeArticles cleans a slice of articles in place.
+func (h *ArticleHandler) sanitizeArticles(articles []*domain.Article) {
+	for _, a := range articles {
+		h.sanitizeArticle(a)
+	}
+}
+
 // getUserFromRequest extracts the authenticated user from the request.
 func (h *ArticleHandler) getUserFromRequest(r *http.Request) (uuid.UUID, error) {
 	cookie, err := r.Cookie("session_id")
@@ -79,6 +101,7 @@ func (h *ArticleHandler) List(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	h.sanitizeArticles(articles)
 	respondJSON(w, http.StatusOK, articles)
 }
 
@@ -120,6 +143,7 @@ func (h *ArticleHandler) ListByFeed(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	h.sanitizeArticles(articles)
 	respondJSON(w, http.StatusOK, articles)
 }
 
@@ -150,12 +174,8 @@ func (h *ArticleHandler) Get(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// Sanitize content
-	if article.Content != "" {
-		article.Content = h.sanitizer.Sanitize(article.Content)
-	} else if article.Summary != "" {
-		article.Summary = h.sanitizer.Sanitize(article.Summary)
-	}
+	// Sanitize user-facing HTML content (defense against stored XSS).
+	h.sanitizeArticle(article)
 
 	respondJSON(w, http.StatusOK, article)
 }
@@ -358,6 +378,7 @@ func (h *ArticleHandler) GetFavorites(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	h.sanitizeArticles(articles)
 	respondJSON(w, http.StatusOK, articles)
 }
 
@@ -391,6 +412,7 @@ func (h *ArticleHandler) Search(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	h.sanitizeArticles(articles)
 	respondJSON(w, http.StatusOK, articles)
 }