Fix push-digest sentinel filter, watermark, and cleanups from review

- push digest queries now exclude _duplicate channel like every other
  visibility query (bookmarks list/count and NewClassifiedSince)
- advance push watermark to newest scanned story, not pass-start now, so
  stories arriving during a long send pass aren't re-counted next pass
- replace hand-rolled escapeHTMLText with stdlib html.EscapeString
- drop em-dashes from user-facing copy; bump PWA CACHE_VERSION so clients
  pick up the changed shell assets

internal/storage/push.go

@@ -96,7 +96,7 @@ func NewClassifiedSince(sinceUnix int64, limit int) ([]Story, error) {
 	rows, err := Get().Query(
 		`SELECT id, headline, source, channel, seen_at
 		 FROM stories
-		 WHERE classified = 1 AND channel <> '_discarded' AND seen_at > ?
+		 WHERE classified = 1 AND channel NOT IN ('_discarded', '_duplicate') AND seen_at > ?
 		 ORDER BY seen_at DESC
 		 LIMIT ?`, sinceUnix, limit)
 	if err != nil {

internal/storage/userstate.go

@@ -104,6 +104,7 @@ func ListBookmarks(sub string, limit, offset int) ([]Story, error) {
 		 WHERE u.user_sub = ?
 		   AND u.bookmarked_at IS NOT NULL
 		   AND s.classified = 1
+		   AND s.channel NOT IN ('_discarded', '_duplicate')
 		 ORDER BY u.bookmarked_at DESC, u.story_id DESC
 		 LIMIT ? OFFSET ?`, sub, limit, offset)
 	if err != nil {
@@ -129,7 +130,8 @@ func CountBookmarks(sub string) (int, error) {
 	err := Get().QueryRow(
 		`SELECT COUNT(*) FROM user_story_state u
 		 JOIN stories s ON s.id = u.story_id
-		 WHERE u.user_sub = ? AND u.bookmarked_at IS NOT NULL AND s.classified = 1`,
+		 WHERE u.user_sub = ? AND u.bookmarked_at IS NOT NULL AND s.classified = 1
+		   AND s.channel NOT IN ('_discarded', '_duplicate')`,
 		sub).Scan(&n)
 	return n, err
 }