Add personalization, outbound feeds, and PWA/push to the web UI

A multi-session build turning Pete's read-only web UI into something people
return to. Five phases, signed-in features keyed off the OIDC subject; anonymous
visitors keep the reverse-chron feed and localStorage-only state.

Phase 1 — per-user read + bookmark state: user_story_state table +
storage/userstate.go; auth-gated /api/read, /api/bookmark, /api/state and a
/bookmarks page; reader.js syncs state server-side for signed-in users. Also
hides the Matrix-posting UI when posting.enabled=false (web-only mode).

Phase 2 — outbound feeds: storage.ListForFeed + web/feed.go hand-build RSS 2.0
(content:encoded) and JSON Feed 1.1 (no new dep); /feed.xml, /feed.json and
per-channel variants; <link rel=alternate> discovery tags.

Phase 3 — "For you" + related: storage/rank.go scores recent unread candidates
by channel/source affinity + recency decay; RelatedStories via FTS5. ForYou rail
+ /for-you page; public /api/related feeds the reader's "You might also like".

Phase 4 — source-health dashboard: source_health table + storage/sourcehealth.go
(RecordPollResult, ListSourceHealth, SourceContentStats), written by the poller;
admin-gated /status page behind web.admin_subs.

Phase 5 — PWA + offline reader + Web Push: root-scoped manifest.webmanifest and
sw.js (app-shell precache, /api/article runtime cache for offline reading,
offline fallback, push/notificationclick handlers); PNG icons from pete.avif;
pwa.js registers the SW and drives a notifications toggle. Web Push adds
webpush-go, a [web.push] config block (pete -genvapid mints VAPID keys), a
push_subscriptions table, auth-gated subscribe/unsubscribe endpoints, and a
digest sender that pings each subscriber "N new stories" past their watermark,
honoring disabled-sources and pruning gone endpoints.

Tests added beside each new storage/web file; go test ./... and go vet clean.

internal/web/push_sender_test.go

@@ -0,0 +1,58 @@
+package web
+
+import (
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"pete/internal/storage"
+)
+
+func TestDisabledSourcesFor(t *testing.T) {
+	storage.Close()
+	if err := storage.Init(filepath.Join(t.TempDir(), "push.db")); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { storage.Close() })
+
+	// The stored blob mirrors localStorage: the disabledSources value is itself a
+	// JSON *string* encoding a {source: true} map (see prefs.js snapshot()).
+	blob := `{"pete.disabledSources.v1":"{\"Feed A\":true,\"Feed B\":false}","pete.weather.loc.v1":"1000-100"}`
+	if err := storage.PutUserPrefs("sub-1", blob, "u", "u@x"); err != nil {
+		t.Fatal(err)
+	}
+
+	got := disabledSourcesFor("sub-1")
+	if !got["Feed A"] {
+		t.Error("Feed A should be disabled")
+	}
+	if got["Feed B"] {
+		t.Error("Feed B is false in prefs and must not be treated as disabled")
+	}
+	if len(got) != 1 {
+		t.Errorf("disabled set = %v, want just {Feed A}", got)
+	}
+
+	// A user with no prefs disables nothing.
+	if len(disabledSourcesFor("nobody")) != 0 {
+		t.Error("unknown user should have an empty disabled set")
+	}
+}
+
+func TestBuildDigestPayload(t *testing.T) {
+	single := string(buildDigestPayload(1, "Only Story"))
+	if !strings.Contains(single, "1 new story") || strings.Contains(single, "1 new stories") {
+		t.Errorf("singular wording wrong: %s", single)
+	}
+	if !strings.Contains(single, "Only Story") {
+		t.Errorf("top headline missing: %s", single)
+	}
+
+	many := string(buildDigestPayload(7, "Big One"))
+	if !strings.Contains(many, "7 new stories") || !strings.Contains(many, "Big One") {
+		t.Errorf("plural payload wrong: %s", many)
+	}
+	if !strings.Contains(many, `"tag":"pete-digest"`) {
+		t.Errorf("expected digest tag in payload: %s", many)
+	}
+}