Fix push-digest sentinel filter, watermark, and cleanups from review

- push digest queries now exclude _duplicate channel like every other
  visibility query (bookmarks list/count and NewClassifiedSince)
- advance push watermark to newest scanned story, not pass-start now, so
  stories arriving during a long send pass aren't re-counted next pass
- replace hand-rolled escapeHTMLText with stdlib html.EscapeString
- drop em-dashes from user-facing copy; bump PWA CACHE_VERSION so clients
  pick up the changed shell assets

internal/web/push_sender.go

@@ -56,7 +56,6 @@ func (s *Server) sendDigests() {
 	if len(subs) == 0 {
 		return
 	}
-	now := time.Now().Unix()
 	// Disabled-source sets are per user; cache within a pass so a user with
 	// several devices only parses prefs once.
 	disabledByUser := make(map[string]map[string]bool)
@@ -116,7 +115,11 @@ func (s *Server) sendDigests() {
 			slog.Warn("push: send failed", "sub", sub.UserSub, "err", err)
 			continue
 		}
-		if derr := storage.TouchPushSubscription(sub.Endpoint, now); derr != nil {
+		// Advance to the newest story this digest actually accounted for, not a
+		// pass-start "now": the loop can run for minutes (one slow endpoint per
+		// send), so stories arriving mid-pass would otherwise be re-counted next
+		// pass. stories[0] is the newest in the scanned window (seen_at DESC).
+		if derr := storage.TouchPushSubscription(sub.Endpoint, stories[0].SeenAt); derr != nil {
 			slog.Error("push: advance watermark failed", "err", derr)
 		}
 		sent++
@@ -133,7 +136,7 @@ func buildDigestPayload(count int, top string) []byte {
 		body = "1 new story"
 	}
 	if top != "" {
-		body += " — " + top
+		body += ": " + top
 	}
 	b, _ := json.Marshal(map[string]string{
 		"title": "Pete has fresh news",