Make paywalls systemic + fix ArticleCard reactivity

- ArticleCard: derive safeHref from article.url and reset image-failure state
  when the article changes, so in-place replacements re-evaluate correctly
  (clears the Svelte capture warning; build is warning-free again).
- Downweight paywalled stories below readable ones (stable sort) when composing
  the daily five and in feed results — the brief now leads readable and rarely
  hands over a locked door.
- review_sources gains a 'paywall-heavy' advisory flag (Nature, New Scientist
  flag at 100%); never auto-deactivates.
- New Scientist/Nature kept active but no longer reach the daily five; they
  remain browsable with the label + Replace.
- Tests: brief readability preference + paywall-heavy flag (79 total).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

goodnews/briefs.py

@@ -3,6 +3,8 @@ from __future__ import annotations
 import sqlite3
 from datetime import date
 
+from .paywall import is_paywalled
+
 
 def build_daily_brief(
     conn: sqlite3.Connection,
@@ -24,6 +26,10 @@ def build_daily_brief(
     ).lastrowid
 
     rows = _candidate_articles(conn, target_date, window_days)
+    # A calm daily brief shouldn't repeatedly hand the reader a locked door:
+    # push paywalled candidates below readable ones (stable, so composite order
+    # is preserved within each group) before selecting the five.
+    rows = sorted(rows, key=lambda r: is_paywalled(r["canonical_url"]))
     selected = _select_diverse(rows, limit)
     for index, row in enumerate(selected, start=1):
         conn.execute(