Harden paywall detection + render paywalled stamp on cards

Bypass-UA retry (Googlebot + Google referer) for soft paywalls, JSON-LD
gating scoped to Article-typed nodes, HTTP 402 treated as explicit
paywall, Wayback freshness filter (30d cap), archive.today as secondary
archive fallback, and transport failures no longer trigger snapshot
swaps. When gating is detected and no archive workaround succeeds, the
story is stored with paywalled=1 and the web card renders a diagonal
red rubber-stamp overlay so readers know the link is gated.

internal/web/handlers.go

@@ -22,6 +22,7 @@ type StoryView struct {
 	Source     string
 	SeenAt     time.Time
 	Posted     bool
+	Paywalled  bool   // source is gated and no archive workaround succeeded
 	Channel    string // channel slug; also the theme key
 }
 
@@ -34,6 +35,7 @@ func toView(s storage.Story) StoryView {
 		Source:     s.Source,
 		SeenAt:     time.Unix(s.SeenAt, 0),
 		Posted:     s.Posted,
+		Paywalled:  s.Paywalled,
 		Channel:    s.Channel,
 	}
 }