feat(web): unified reader with reading settings, faster lists, a11y

- New Reader (desktop + mobile): loads full content on open, prefetches
  the next article, reading progress and time, "Aa" settings (light /
  sepia / dark / auto theme, serif / sans / Atkinson Hyperlegible font,
  size, line height, measure), Space-to-next, keyboard shortcuts, focus
  management, inert background, URL-driven (?a=) so Back closes it.
- Dashboard: cursor pagination, unread/all filter, CSS grid (no masonry),
  no re-sorting under the reader, optimistic cache patches instead of
  refetch storms, "new articles" banner, error/offline states, j/k/o/m/s/v
  shortcuts and help dialog.
- Cards: keyboard-openable, lazy <img>, memoized, touch-only swipe.
- Focus mode: framer drag (drop @use-gesture), Read button, undo restores
  unread state, arrow keys.
- WebSocket: single connection, backoff, cache patching, no console logs.
- Contrast fixes (on-nature tokens), 44px targets, lang="fr", reduced
  motion, self-hosted fonts, theme applied before first paint.
- Code splitting + vendor chunk, prompt-based PWA updates, smaller
  precache, offline cache for opened articles and images, caches cleared
  on logout; upgrade react-router (CVE), drop unused deps and assets.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/src/lib/html.ts

@@ -0,0 +1,38 @@
+/**
+ * Prepares sanitized article HTML for display: lazy-loads images, drops the
+ * first image when it duplicates the hero, and strips tracking pixels.
+ * The HTML is already sanitized server-side; DOMParser never runs scripts.
+ */
+export function prepareArticleHtml(html: string, heroUrl?: string): string {
+    if (!html) return '';
+    const doc = new DOMParser().parseFromString(`<body>${html}</body>`, 'text/html');
+    const imgs = Array.from(doc.body.querySelectorAll('img'));
+    const heroKey = heroUrl ? stripQuery(heroUrl) : '';
+
+    imgs.forEach((img, i) => {
+        const src = img.getAttribute('src') ?? '';
+        if (!src || img.getAttribute('width') === '1' || img.getAttribute('height') === '1') {
+            img.remove();
+            return;
+        }
+        if (i === 0 && heroKey && stripQuery(src) === heroKey) {
+            (img.closest('figure') ?? img).remove();
+            return;
+        }
+        img.setAttribute('loading', 'lazy');
+        img.setAttribute('decoding', 'async');
+        img.setAttribute('referrerpolicy', 'no-referrer');
+    });
+
+    // Empty paragraphs left behind by removed images / feed markup.
+    doc.body.querySelectorAll('p').forEach((p) => {
+        if (!p.textContent?.trim() && !p.querySelector('img,video,iframe')) p.remove();
+    });
+
+    return doc.body.innerHTML;
+}
+
+function stripQuery(u: string) {
+    const i = u.search(/[?#]/);
+    return i === -1 ? u : u.slice(0, i);
+}