Fix push SSRF, cross-user unsub, and personalization edge cases

Code review of the personalization/feeds/PWA/push work surfaced ten
confirmed issues, now fixed:

- Web Push delivery bypassed the SSRF guard (unguarded default client);
  now routes through safehttp.NewClient with a hard timeout, and the
  subscribe handler validates the endpoint URL.
- Push unsubscribe deleted by endpoint with no owner check; added
  RemovePushSubscriptionForUser scoped to the signed-in user.
- Byte-slice body/content truncation could split a UTF-8 rune and break
  the RSS content:encoded XML; added a rune-safe truncateUTF8 helper.
- Digest sender could permanently starve a user who hid a high-volume
  source; step the watermark past a full hidden-source scan window.
- Service worker cached personalized HTML navigations into a shared
  cache (identity leak across PWA users); navigations are now
  network-only, CACHE_VERSION bumped to v2 to purge stale pages.
- Public /api/article leaked discarded/unclassified bodies; filter to
  classified, non-sentinel stories.
- runLocal never started the push sender; digests now fire in -local.
- Push client had no timeout, so one hung endpoint stalled all sends.
- Reader migration resurrected cross-device-cleared reads; gate it
  behind a one-time flag so the server stays authoritative.
- Bookmarks count didn't match the classified list filter.

internal/storage/push.go

@@ -34,8 +34,10 @@ func AddPushSubscription(sub, endpoint, p256dh, auth string) error {
 	return nil
 }
 
-// RemovePushSubscription drops one endpoint. Used both for an explicit opt-out
-// and when a push service reports the endpoint is gone (404/410).
+// RemovePushSubscription drops one endpoint regardless of owner. Reserved for
+// the digest sender's prune path, where a push service has reported the endpoint
+// gone (404/410) and there's no caller identity to scope by. User-initiated
+// opt-outs must use RemovePushSubscriptionForUser.
 func RemovePushSubscription(endpoint string) error {
 	_, err := Get().Exec(`DELETE FROM push_subscriptions WHERE endpoint = ?`, endpoint)
 	if err != nil {
@@ -44,6 +46,18 @@ func RemovePushSubscription(endpoint string) error {
 	return nil
 }
 
+// RemovePushSubscriptionForUser drops an endpoint only if it belongs to sub, so
+// a signed-in user can't unsubscribe another account's device by presenting its
+// endpoint string. A no-op (no matching row) is not an error.
+func RemovePushSubscriptionForUser(sub, endpoint string) error {
+	_, err := Get().Exec(
+		`DELETE FROM push_subscriptions WHERE endpoint = ? AND user_sub = ?`, endpoint, sub)
+	if err != nil {
+		return fmt.Errorf("remove push subscription: %w", err)
+	}
+	return nil
+}
+
 // ListPushSubscriptions returns every stored subscription, for the digest sender.
 func ListPushSubscriptions() ([]PushSubscription, error) {
 	rows, err := Get().Query(