Add personalization, outbound feeds, and PWA/push to the web UI

A multi-session build turning Pete's read-only web UI into something people
return to. Five phases, signed-in features keyed off the OIDC subject; anonymous
visitors keep the reverse-chron feed and localStorage-only state.

Phase 1 — per-user read + bookmark state: user_story_state table +
storage/userstate.go; auth-gated /api/read, /api/bookmark, /api/state and a
/bookmarks page; reader.js syncs state server-side for signed-in users. Also
hides the Matrix-posting UI when posting.enabled=false (web-only mode).

Phase 2 — outbound feeds: storage.ListForFeed + web/feed.go hand-build RSS 2.0
(content:encoded) and JSON Feed 1.1 (no new dep); /feed.xml, /feed.json and
per-channel variants; <link rel=alternate> discovery tags.

Phase 3 — "For you" + related: storage/rank.go scores recent unread candidates
by channel/source affinity + recency decay; RelatedStories via FTS5. ForYou rail
+ /for-you page; public /api/related feeds the reader's "You might also like".

Phase 4 — source-health dashboard: source_health table + storage/sourcehealth.go
(RecordPollResult, ListSourceHealth, SourceContentStats), written by the poller;
admin-gated /status page behind web.admin_subs.

Phase 5 — PWA + offline reader + Web Push: root-scoped manifest.webmanifest and
sw.js (app-shell precache, /api/article runtime cache for offline reading,
offline fallback, push/notificationclick handlers); PNG icons from pete.avif;
pwa.js registers the SW and drives a notifications toggle. Web Push adds
webpush-go, a [web.push] config block (pete -genvapid mints VAPID keys), a
push_subscriptions table, auth-gated subscribe/unsubscribe endpoints, and a
digest sender that pings each subscriber "N new stories" past their watermark,
honoring disabled-sources and pruning gone endpoints.

Tests added beside each new storage/web file; go test ./... and go vet clean.

main.go

@@ -21,9 +21,22 @@ import (
 	"pete/internal/storage"
 	"pete/internal/web"
 
+	webpush "github.com/SherClockHolmes/webpush-go"
 	"maunium.net/go/mautrix/id"
 )
 
+// runGenVAPID prints a fresh VAPID keypair for the [web.push] config block.
+func runGenVAPID() {
+	priv, pub, err := webpush.GenerateVAPIDKeys()
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "genvapid: failed:", err)
+		os.Exit(1)
+	}
+	fmt.Println("# Add these under [web.push] in your config:")
+	fmt.Printf("vapid_public_key = %q\n", pub)
+	fmt.Printf("vapid_private_key = %q\n", priv)
+}
+
 func main() {
 	configPath := flag.String("config", "config.toml", "path to config file")
 	seed := flag.Bool("seed", false, "ingest current feed items as seen without posting, then exit")
@@ -31,8 +44,15 @@ func main() {
 	testSource := flag.String("test-source", "", "source name to use for -test (default: first enabled)")
 	local := flag.Bool("local", false, "web/RSS-only mode: poll feeds and serve the web UI, no Matrix login or posting")
 	backfillPaywall := flag.Bool("backfill-paywall", false, "re-check paywalled rows with current detection logic; clear false positives and fill missing thumbnails, then exit")
+	genVAPID := flag.Bool("genvapid", false, "generate a VAPID keypair for web.push and print it, then exit")
 	flag.Parse()
 
+	// -genvapid needs neither config nor database; handle it before anything else.
+	if *genVAPID {
+		runGenVAPID()
+		return
+	}
+
 	slog.SetDefault(slog.New(slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{
 		Level: slog.LevelInfo,
 	})))
@@ -240,11 +260,12 @@ func main() {
 
 	// Start the read-only web UI alongside the Matrix bot.
 	if cfg.Web.Enabled {
-		ws, err := web.New(cfg.Web, cfg.Sources)
+		ws, err := web.New(cfg.Web, cfg.Sources, postingEnabled)
 		if err != nil {
 			slog.Error("web server init failed", "err", err)
 		} else {
 			go ws.Start(ctx)
+			ws.StartPushSender(ctx)
 		}
 	}
 
@@ -349,7 +370,8 @@ func runLocal(cfg *config.Config) {
 	poller.Start(ctx)
 	slog.Info("local: pollers started")
 
-	ws, err := web.New(cfg.Web, cfg.Sources)
+	// Local mode never connects to Matrix, so it's always web-only.
+	ws, err := web.New(cfg.Web, cfg.Sources, false)
 	if err != nil {
 		slog.Error("local: web server init failed", "err", err)
 		os.Exit(1)