Web UI: music channel, posted-to-Matrix glow, redesigned index, AVIF thumbnails

- Add music as a fourth channel (nav + theme color)
- Glowing themed border on cards that have been posted to Matrix
- Replace per-channel index sections with: "Pete just posted" strip,
  channel dashboard (last post, 24h count, totals), unified latest feed
- /img proxy: SSRF-guarded thumbnail re-encoder that resizes to 800px
  and runs avifenc -q 45, cached under data/img-cache

internal/storage/queries.go

@@ -220,22 +220,76 @@ func GetNewestPostableStoryByChannel(channel string) (*Story, error) {
 // channels (_discarded, _duplicate) are excluded.
 func ListClassifiedByChannel(channel string, limit, offset int) ([]Story, error) {
 	rows, err := Get().Query(
-		`SELECT guid, headline, lede, image_url, article_url, source, platforms, channel, seen_at
-		 FROM stories
-		 WHERE classified = 1
-		   AND channel = ?
-		 ORDER BY seen_at DESC
+		`SELECT s.guid, s.headline, s.lede, s.image_url, s.article_url, s.source, s.platforms, s.channel, s.seen_at,
+		        EXISTS(SELECT 1 FROM post_log p WHERE p.guid = s.guid) AS posted
+		 FROM stories s
+		 WHERE s.classified = 1
+		   AND s.channel = ?
+		 ORDER BY s.seen_at DESC
 		 LIMIT ? OFFSET ?`, channel, limit, offset)
 	if err != nil {
 		return nil, err
 	}
 	defer rows.Close()
 	var out []Story
+	for rows.Next() {
+		var s Story
+		if err := rows.Scan(&s.GUID, &s.Headline, &s.Lede, &s.ImageURL, &s.ArticleURL, &s.Source, &s.Platforms, &s.Channel, &s.SeenAt, &s.Posted); err != nil {
+			return nil, err
+		}
+		out = append(out, s)
+	}
+	return out, rows.Err()
+}
+
+// ListAllClassified returns up to `limit` classified stories across all real
+// channels, newest first. Sentinel channels are excluded.
+func ListAllClassified(limit, offset int) ([]Story, error) {
+	rows, err := Get().Query(
+		`SELECT s.guid, s.headline, s.lede, s.image_url, s.article_url, s.source, s.platforms, s.channel, s.seen_at,
+		        EXISTS(SELECT 1 FROM post_log p WHERE p.guid = s.guid) AS posted
+		 FROM stories s
+		 WHERE s.classified = 1
+		   AND s.channel IS NOT NULL
+		   AND s.channel NOT IN ('_discarded', '_duplicate')
+		 ORDER BY s.seen_at DESC
+		 LIMIT ? OFFSET ?`, limit, offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var out []Story
+	for rows.Next() {
+		var s Story
+		if err := rows.Scan(&s.GUID, &s.Headline, &s.Lede, &s.ImageURL, &s.ArticleURL, &s.Source, &s.Platforms, &s.Channel, &s.SeenAt, &s.Posted); err != nil {
+			return nil, err
+		}
+		out = append(out, s)
+	}
+	return out, rows.Err()
+}
+
+// ListRecentlyPosted returns up to `limit` stories that have been posted to
+// Matrix, ordered by post time (newest first). Posted is always true.
+func ListRecentlyPosted(limit int) ([]Story, error) {
+	rows, err := Get().Query(
+		`SELECT s.guid, s.headline, s.lede, s.image_url, s.article_url, s.source, s.platforms, s.channel, s.seen_at
+		 FROM stories s
+		 JOIN post_log p ON p.guid = s.guid
+		 GROUP BY s.guid
+		 ORDER BY MAX(p.posted_at) DESC
+		 LIMIT ?`, limit)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var out []Story
 	for rows.Next() {
 		var s Story
 		if err := rows.Scan(&s.GUID, &s.Headline, &s.Lede, &s.ImageURL, &s.ArticleURL, &s.Source, &s.Platforms, &s.Channel, &s.SeenAt); err != nil {
 			return nil, err
 		}
+		s.Posted = true
 		out = append(out, s)
 	}
 	return out, rows.Err()
@@ -250,6 +304,20 @@ func CountClassifiedByChannel(channel string) (int, error) {
 	return n, err
 }
 
+// IsKnownImageURL reports whether any story has this exact image_url. Used
+// by the thumbnail proxy to guard against arbitrary URL fetches.
+func IsKnownImageURL(url string) bool {
+	if url == "" {
+		return false
+	}
+	var n int
+	if err := Get().QueryRow(`SELECT COUNT(*) FROM stories WHERE image_url = ? LIMIT 1`, url).Scan(&n); err != nil {
+		slog.Error("IsKnownImageURL query failed", "err", err)
+		return false
+	}
+	return n > 0
+}
+
 // GetRoundRobinState returns the last channel posted by the round-robin
 // scheduler and the timestamp of that tick. Empty string + 0 if no state yet.
 func GetRoundRobinState() (lastChannel string, lastTickAt int64, err error) {

internal/storage/types.go

@@ -15,4 +15,5 @@ type Story struct {
 	Channel      string
 	Classified   bool
 	SeenAt       int64
+	Posted       bool // true if this story has been posted to Matrix (joined from post_log)
 }