Add personalization, outbound feeds, and PWA/push to the web UI

A multi-session build turning Pete's read-only web UI into something people
return to. Five phases, signed-in features keyed off the OIDC subject; anonymous
visitors keep the reverse-chron feed and localStorage-only state.

Phase 1 — per-user read + bookmark state: user_story_state table +
storage/userstate.go; auth-gated /api/read, /api/bookmark, /api/state and a
/bookmarks page; reader.js syncs state server-side for signed-in users. Also
hides the Matrix-posting UI when posting.enabled=false (web-only mode).

Phase 2 — outbound feeds: storage.ListForFeed + web/feed.go hand-build RSS 2.0
(content:encoded) and JSON Feed 1.1 (no new dep); /feed.xml, /feed.json and
per-channel variants; <link rel=alternate> discovery tags.

Phase 3 — "For you" + related: storage/rank.go scores recent unread candidates
by channel/source affinity + recency decay; RelatedStories via FTS5. ForYou rail
+ /for-you page; public /api/related feeds the reader's "You might also like".

Phase 4 — source-health dashboard: source_health table + storage/sourcehealth.go
(RecordPollResult, ListSourceHealth, SourceContentStats), written by the poller;
admin-gated /status page behind web.admin_subs.

Phase 5 — PWA + offline reader + Web Push: root-scoped manifest.webmanifest and
sw.js (app-shell precache, /api/article runtime cache for offline reading,
offline fallback, push/notificationclick handlers); PNG icons from pete.avif;
pwa.js registers the SW and drives a notifications toggle. Web Push adds
webpush-go, a [web.push] config block (pete -genvapid mints VAPID keys), a
push_subscriptions table, auth-gated subscribe/unsubscribe endpoints, and a
digest sender that pings each subscriber "N new stories" past their watermark,
honoring disabled-sources and pruning gone endpoints.

Tests added beside each new storage/web file; go test ./... and go vet clean.

internal/storage/queries.go

@@ -300,6 +300,55 @@ func ListAllClassified(limit, offset int) ([]Story, error) {
 	return out, rows.Err()
 }
 
+// ListForFeed returns up to `limit` classified stories for the outbound RSS and
+// JSON feeds, newest first. Unlike the web list queries it also selects the full
+// `content` and `published_at`, which the feeds need for content:encoded bodies
+// and real pubDates. channel == "" spans all real channels; otherwise it scopes
+// to that one channel. Sentinel channels are always excluded.
+func ListForFeed(channel string, limit int) ([]Story, error) {
+	const cols = `s.id, s.guid, s.headline, s.lede, s.content, s.image_url, s.article_url, s.url_canonical, s.source, s.channel, s.seen_at, s.published_at`
+	var (
+		rows *sql.Rows
+		err  error
+	)
+	if channel == "" {
+		rows, err = Get().Query(
+			`SELECT `+cols+`
+			 FROM stories s
+			 WHERE s.classified = 1
+			   AND s.channel IS NOT NULL
+			   AND s.channel NOT IN ('_discarded', '_duplicate')
+			 ORDER BY COALESCE(s.published_at, s.seen_at) DESC
+			 LIMIT ?`, limit)
+	} else {
+		rows, err = Get().Query(
+			`SELECT `+cols+`
+			 FROM stories s
+			 WHERE s.classified = 1
+			   AND s.channel = ?
+			 ORDER BY COALESCE(s.published_at, s.seen_at) DESC
+			 LIMIT ?`, channel, limit)
+	}
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var out []Story
+	for rows.Next() {
+		var s Story
+		var content, canonical sql.NullString
+		var published sql.NullInt64
+		if err := rows.Scan(&s.ID, &s.GUID, &s.Headline, &s.Lede, &content, &s.ImageURL, &s.ArticleURL, &canonical, &s.Source, &s.Channel, &s.SeenAt, &published); err != nil {
+			return nil, err
+		}
+		s.Content = content.String
+		s.URLCanonical = canonical.String
+		s.PublishedAt = published.Int64
+		out = append(out, s)
+	}
+	return out, rows.Err()
+}
+
 // ListRecentlyPosted returns up to `limit` stories that have been posted to
 // Matrix, ordered by post time (newest first). Posted is always true.
 func ListRecentlyPosted(limit int) ([]Story, error) {