Supervised source candidates: stage, list, promote, reject

- New source_candidates staging table (status suggested/quarantined/rejected/
  promoted, preview_json snapshot) so untrusted/suggested feeds stay out of the
  real ingestion path until reviewed.
- sources.py: save_candidate (re-preview never revives a curator's rejection),
  list_candidates, reject_candidate, promote_candidate (copies into sources,
  inactive by default — active on approval; never automatic).
- CLI: suggest-source / list-candidates / promote-candidate / reject-candidate.
- API: read-only GET /api/candidates (writes stay CLI-only — no unauthenticated
  public write surface yet).
- Fix deprecated ElementTree truth-value test in _parse_rss.
- Tests: candidate lifecycle (save/list/promote/reject, status preservation,
  name derivation) — 51 total.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_candidates.py

@@ -0,0 +1,61 @@
+import pytest
+
+from goodnews.db import connect, init_db
+from goodnews.sources import (
+    list_candidates,
+    promote_candidate,
+    reject_candidate,
+    save_candidate,
+)
+
+
+@pytest.fixture
+def conn():
+    c = connect(":memory:")
+    init_db(c)
+    yield c
+    c.close()
+
+
+def test_save_and_list_candidate(conn):
+    cand = save_candidate(conn, "http://x/feed", preview={"acceptance_rate": 0.8, "sampled": 10}, name="X")
+    assert cand["status"] == "quarantined"
+    rows = list_candidates(conn)
+    assert len(rows) == 1 and rows[0]["feed_url"] == "http://x/feed"
+
+
+def test_re_preview_preserves_curator_status(conn):
+    save_candidate(conn, "http://x/feed")
+    reject_candidate(conn, list_candidates(conn)[0]["id"])
+    # Re-previewing must NOT revive a rejected feed.
+    save_candidate(conn, "http://x/feed", preview={"acceptance_rate": 0.9})
+    assert list_candidates(conn)[0]["status"] == "rejected"
+
+
+def test_promote_creates_inactive_source_and_marks_promoted(conn):
+    cand = save_candidate(conn, "http://x/feed", name="Lovely Feed")
+    source_id = promote_candidate(conn, cand["id"])  # inactive by default
+
+    src = conn.execute("SELECT name, active FROM sources WHERE id = ?", (source_id,)).fetchone()
+    assert src["name"] == "Lovely Feed"
+    assert src["active"] == 0  # active-on-approval: not polled until activated
+
+    status = conn.execute("SELECT status FROM source_candidates WHERE id = ?", (cand["id"],)).fetchone()["status"]
+    assert status == "promoted"
+
+
+def test_promote_active_flag(conn):
+    cand = save_candidate(conn, "http://y/feed", name="Y")
+    sid = promote_candidate(conn, cand["id"], active=True)
+    assert conn.execute("SELECT active FROM sources WHERE id = ?", (sid,)).fetchone()["active"] == 1
+
+
+def test_promote_unknown_raises(conn):
+    with pytest.raises(ValueError):
+        promote_candidate(conn, 999)
+
+
+def test_name_derived_from_url_when_missing(conn):
+    cand = save_candidate(conn, "https://news.example.org/rss")
+    sid = promote_candidate(conn, cand["id"])
+    assert conn.execute("SELECT name FROM sources WHERE id = ?", (sid,)).fetchone()["name"] == "news.example.org"