Harden Calm Filters surface before Track 3

- Add API test layer (TestClient): bad prefs -> 200, mute affects feed,
  avoid-term filters, brief filters down, counts match filtered feed.
- Render article cards via the DOM API (textContent) instead of HTML string
  interpolation, and only allow http(s) hrefs — defense-in-depth XSS guard for
  when the feed faces untrusted sources publicly.
- Refresh the stale README Next Steps to reflect what's done vs ahead.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_api.py

@@ -0,0 +1,76 @@
+import json
+
+import pytest
+from fastapi.testclient import TestClient
+
+from goodnews.db import connect, init_db
+
+
+@pytest.fixture
+def client(tmp_path, monkeypatch):
+    db = tmp_path / "test.sqlite3"
+    monkeypatch.setenv("GOODNEWS_DB", str(db))
+
+    conn = connect(db)
+    init_db(conn)
+    conn.execute("INSERT INTO sources (id, name, feed_url, trust_score) VALUES (1,'S','http://s/f',7)")
+
+    def add(aid, topic, flavor, title):
+        conn.execute(
+            "INSERT INTO articles (id, source_id, canonical_url, title, published_at, url_hash) "
+            "VALUES (?,1,?,?, '2026-05-30T10:00:00+00:00', ?)",
+            (aid, f"http://s/{aid}", title, f"h{aid}"),
+        )
+        conn.execute(
+            "INSERT INTO article_scores (article_id, constructive_score, agency_score, "
+            "human_benefit_score, cortisol_score, ragebait_score, pr_risk_score, accepted, topic, flavor) "
+            "VALUES (?, 7, 3, 4, 1, 0, 2, 1, ?, ?)",
+            (aid, topic, flavor),
+        )
+
+    add(1, "science", "discovery", "A quiet science discovery")
+    add(2, "health", "breakthrough", "Election season health update")  # has avoid-able term
+    conn.execute("INSERT INTO daily_briefs (id, brief_date, title) VALUES (1,'2026-05-30','Brief')")
+    conn.execute("INSERT INTO daily_brief_items (brief_id, article_id, rank) VALUES (1,1,1),(1,2,2)")
+    conn.commit()
+    conn.close()
+
+    # Import after env is set so the app reads the temp DB.
+    from goodnews.api import create_app
+
+    return TestClient(create_app())
+
+
+def _prefs(client, **kw):
+    return client.get("/api/feed", params={"prefs": json.dumps(kw)})
+
+
+def test_bad_prefs_returns_200_and_full_feed(client):
+    r = client.get("/api/feed", params={"prefs": "not json at all"})
+    assert r.status_code == 200
+    assert r.json()["count"] == 2  # forgiving: bad blob ignored
+
+
+def test_mute_topic_affects_feed(client):
+    r = _prefs(client, mute_topics=["science"])
+    topics = [i["topic"] for i in r.json()["items"]]
+    assert topics == ["health"]
+
+
+def test_avoid_term_filters_feed(client):
+    r = _prefs(client, avoid_terms=["election"])
+    titles = [i["title"] for i in r.json()["items"]]
+    assert all("election" not in t.lower() for t in titles)
+    assert len(titles) == 1
+
+
+def test_brief_filters_down_without_refill(client):
+    full = client.get("/api/brief").json()
+    assert len(full["items"]) == 2
+    muted = client.get("/api/brief", params={"prefs": json.dumps({"mute_topics": ["health"]})}).json()
+    assert [i["topic"] for i in muted["items"]] == ["science"]
+
+
+def test_category_counts_match_filtered_feed(client):
+    counts = client.get("/api/category-counts", params={"prefs": json.dumps({"mute_topics": ["health"]})}).json()
+    assert all(c["topic"] != "health" for c in counts)