Harden paywall detection + render paywalled stamp on cards

Bypass-UA retry (Googlebot + Google referer) for soft paywalls, JSON-LD
gating scoped to Article-typed nodes, HTTP 402 treated as explicit
paywall, Wayback freshness filter (30d cap), archive.today as secondary
archive fallback, and transport failures no longer trigger snapshot
swaps. When gating is detected and no archive workaround succeeds, the
story is stored with paywalled=1 and the web card renders a diagonal
red rubber-stamp overlay so readers know the link is gated.

internal/storage/schema.go

@@ -14,6 +14,7 @@ CREATE TABLE IF NOT EXISTS stories (
     platforms     TEXT,
     channel       TEXT,
     classified    INTEGER NOT NULL DEFAULT 0,
+    paywalled     INTEGER NOT NULL DEFAULT 0,
     seen_at       INTEGER NOT NULL
 );