Make paywalls systemic + fix ArticleCard reactivity

- ArticleCard: derive safeHref from article.url and reset image-failure state
  when the article changes, so in-place replacements re-evaluate correctly
  (clears the Svelte capture warning; build is warning-free again).
- Downweight paywalled stories below readable ones (stable sort) when composing
  the daily five and in feed results — the brief now leads readable and rarely
  hands over a locked door.
- review_sources gains a 'paywall-heavy' advisory flag (Nature, New Scientist
  flag at 100%); never auto-deactivates.
- New Scientist/Nature kept active but no longer reach the daily five; they
  remain browsable with the label + Replace.
- Tests: brief readability preference + paywall-heavy flag (79 total).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

goodnews/api.py

@@ -281,6 +281,9 @@ def create_app() -> FastAPI:
                         conn, topic=topic, flavor=flavor, accepted_only=accepted_only,
                         limit=limit, offset=offset, **kw,
                     )
+        # Keep the top of a browse view readable: stable-sort paywalled items
+        # below readable ones (composite order preserved within each group).
+        rows = sorted(rows, key=lambda r: is_paywalled(r["canonical_url"]))
         return FeedResponse(
             topic=topic,
             flavor=flavor,