feat: scaffold newsfeed — user-controlled news feed

A self-hosted feed where the user owns the ranking: per-source and signed
per-interest weights, decayed by recency, via a transparent deterministic
scorer. Content is sourced algorithmically (worker RSS/Atom polling) and
agentically (per-user API tokens POSTing candidates to the ingest endpoint).
Single-user today, multi-user by construction (every row keyed on user_id).

Rust cargo workspace + Vite/React/SWC/TS SPA:
- newsfeed-entities: DTOs (ts-rs bindings -> web/src/api/bindings)
- newsfeed-core: ranking, auth primitives, ingest, data-access ports
- newsfeed-data: SQLite adapters (sqlx, runtime queries)
- newsfeed-api: axum REST/JSON daemon
- newsfeed-worker: RSS polling + rescoring loop
- web: responsive, mobile-first SPA (React Query, generated types)

Deploy (Gitea Actions, build static musl + SPA, rsync as gitea_ci):
api+worker -> slartibartfast, SPA -> oolon (nginx serves + proxies /v1).

Deliberate deviations from house conventions (documented in CLAUDE.md/readme):
- SQLite instead of Postgres; api+worker co-locate sharing one DB file.
- Runtime sqlx queries instead of query! macros (SQLite dynamic typing;
  keeps CI database-free).

Verified end-to-end: auth, token ingest, interest-weighted ranking, signals,
pagination (curl + browser); cargo fmt/clippy -D/test and pnpm build/lint pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016fKZzDpvjiJ9eYbPGgJvUP

asset/systemd/newsfeed-api.service

@@ -0,0 +1,38 @@
+[Unit]
+Description=newsfeed REST/JSON API
+Documentation=https://git.lair.cafe/grenade/newsfeed
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+# Type=exec (not notify): axum does not sd_notify READY=1, so notify would block until
+# TimeoutStartSec. exec treats the unit as started once the binary execs successfully.
+Type=exec
+User=newsfeed
+Group=newsfeed
+ExecStart=/usr/local/bin/newsfeed-api --config /etc/newsfeed/config.toml
+Restart=on-failure
+RestartSec=2
+
+# Hardening (architecture generic.md §8). Relax individually only if a feature needs it.
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+SystemCallArchitectures=native
+
+# The SQLite database and WAL live here; shared read/write with newsfeed-worker.
+ReadWritePaths=/var/lib/newsfeed
+
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+
+[Install]
+WantedBy=multi-user.target

asset/systemd/newsfeed-worker.service

@@ -0,0 +1,36 @@
+[Unit]
+Description=newsfeed content-sourcing worker (RSS/Atom polling + rescoring)
+Documentation=https://git.lair.cafe/grenade/newsfeed
+After=network-online.target newsfeed-api.service
+Wants=network-online.target
+
+[Service]
+Type=exec
+User=newsfeed
+Group=newsfeed
+ExecStart=/usr/local/bin/newsfeed-worker --config /etc/newsfeed/worker.toml
+Restart=on-failure
+RestartSec=5
+
+# Hardening (architecture generic.md §8).
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+SystemCallArchitectures=native
+
+# Same database file as the api (co-located: SQLite is single-host).
+ReadWritePaths=/var/lib/newsfeed
+
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+
+[Install]
+WantedBy=multi-user.target

asset/systemd/newsfeed.sysusers.conf

@@ -0,0 +1,2 @@
+#Type Name      ID   GECOS                        Home directory     Shell
+u     newsfeed  -    "newsfeed service account"    /var/lib/newsfeed   /usr/sbin/nologin