Add personalization, outbound feeds, and PWA/push to the web UI

A multi-session build turning Pete's read-only web UI into something people
return to. Five phases, signed-in features keyed off the OIDC subject; anonymous
visitors keep the reverse-chron feed and localStorage-only state.

Phase 1 — per-user read + bookmark state: user_story_state table +
storage/userstate.go; auth-gated /api/read, /api/bookmark, /api/state and a
/bookmarks page; reader.js syncs state server-side for signed-in users. Also
hides the Matrix-posting UI when posting.enabled=false (web-only mode).

Phase 2 — outbound feeds: storage.ListForFeed + web/feed.go hand-build RSS 2.0
(content:encoded) and JSON Feed 1.1 (no new dep); /feed.xml, /feed.json and
per-channel variants; <link rel=alternate> discovery tags.

Phase 3 — "For you" + related: storage/rank.go scores recent unread candidates
by channel/source affinity + recency decay; RelatedStories via FTS5. ForYou rail
+ /for-you page; public /api/related feeds the reader's "You might also like".

Phase 4 — source-health dashboard: source_health table + storage/sourcehealth.go
(RecordPollResult, ListSourceHealth, SourceContentStats), written by the poller;
admin-gated /status page behind web.admin_subs.

Phase 5 — PWA + offline reader + Web Push: root-scoped manifest.webmanifest and
sw.js (app-shell precache, /api/article runtime cache for offline reading,
offline fallback, push/notificationclick handlers); PNG icons from pete.avif;
pwa.js registers the SW and drives a notifications toggle. Web Push adds
webpush-go, a [web.push] config block (pete -genvapid mints VAPID keys), a
push_subscriptions table, auth-gated subscribe/unsubscribe endpoints, and a
digest sender that pings each subscriber "N new stories" past their watermark,
honoring disabled-sources and pruning gone endpoints.

Tests added beside each new storage/web file; go test ./... and go vet clean.

internal/config/config_test.go

@@ -211,6 +211,43 @@ feed_url = "https://e.com/rss"
 tier = 1
 poll_interval_minutes = 20
 enabled = true
+`},
+		{"push enabled without auth", `
+[matrix]
+homeserver = "https://h"
+user_id = "@p:h"
+password = "pw"
+pickle_key = "test_pickle_key_1234"
+[matrix.channels]
+tech = "!t:e"
+[storage]
+db_path = "/tmp/t.db"
+[web.push]
+enabled = true
+vapid_public_key = "pub"
+vapid_private_key = "priv"
+subject = "mailto:a@b.c"
+`},
+		{"push enabled missing keys", `
+[matrix]
+homeserver = "https://h"
+user_id = "@p:h"
+password = "pw"
+pickle_key = "test_pickle_key_1234"
+[matrix.channels]
+tech = "!t:e"
+[storage]
+db_path = "/tmp/t.db"
+[web.auth]
+enabled = true
+issuer = "https://i"
+client_id = "id"
+client_secret = "secret"
+redirect_url = "https://r/cb"
+session_secret = "session_secret_16chars_long"
+[web.push]
+enabled = true
+subject = "mailto:a@b.c"
 `},
 	}