Admin: source Articles inspector (verify metrics against real evidence)

New per-row "Articles" button on the Sources table expands a read-only inline
panel of the source's ACTUAL ingested articles — so the automated metrics
(paywall/image/acceptance/duplicate) can be verified against evidence instead of
trusted blind. Distinct from "Check" (which re-samples the LIVE feed for
would-pass quality); this shows what's already in the DB, which is what the table
metrics are computed from.

- Backend: GET /api/admin/sources/{id}/articles?filter=&limit=&offset= (admin,
  read-only). queries.source_articles + source_articles_summary — per article:
  title, url, date, accepted, reason (the "why"), topic/flavor, paywalled
  (domain rule), has_image, duplicate. Summary = counts + source-level paywall
  rule.
- Frontend: expandable panel with a summary header ("27 ingested · 18 accepted
  · … · paywall rule: ON (domain)"), filter chips (All/Accepted/Rejected/No
  image/Duplicates), compact rows with title→link + badges + reason, Load more.

So "100% paywall" or "0% images" becomes clickable evidence: open two articles
to tell a real paywall from a mis-flagged domain, or a true image gap from an
enrichment failure. Test: test_source_articles_inspector. 241 pytest + 11 vitest.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/test_game_sync.py

@@ -17,11 +17,13 @@ def conn(tmp_path):
 # --- merge logic (the audited core) ---
 
 def test_merge_wordsearch_unions_finds():
-    a = {"foundWords": [{"word": "CAT", "cells": [[0, 0]], "ci": 0}], "startTime": 100, "ms": 0}
-    b = {"foundWords": [{"word": "DOG", "cells": [[1, 1]], "ci": 1}], "startTime": 50, "ms": 0}
+    a = {"foundWords": [{"word": "CAT", "cells": [[0, 0]], "ci": 0}], "played": 9000, "ms": 0}
+    b = {"foundWords": [{"word": "DOG", "cells": [[1, 1]], "ci": 1}], "played": 4000, "ms": 0}
     m = games.merge_game_state("wordsearch", a, b)
     assert {f["word"] for f in m["foundWords"]} == {"CAT", "DOG"}  # union of finds
-    assert m["startTime"] == 50  # earliest start
+    # active-time clock: the device that banked the most play time is the truth —
+    # wall-clock gaps between sittings must never inflate the timer
+    assert m["played"] == 9000
 
 
 def test_merge_wordsearch_dedupes_and_keeps_best_time():
@@ -55,12 +57,12 @@ def _find(word, row):  # a shape-valid find: cells spelling the word along a row
 def test_save_converges_across_devices(conn):
     # No stored puzzle for this date → shape-only sanitize (words 4-12, cells match).
     games.save_game_state(conn, 1, "wordsearch", "small", "2026-06-12",
-                          {"foundWords": [_find("BEACH", 0)], "startTime": 100})
+                          {"foundWords": [_find("BEACH", 0)], "played": 100})
     merged = games.save_game_state(conn, 1, "wordsearch", "small", "2026-06-12",
-                                   {"foundWords": [_find("OCEAN", 1)], "startTime": 50})
+                                   {"foundWords": [_find("OCEAN", 1)], "played": 50})
     assert {f["word"] for f in merged["foundWords"]} == {"BEACH", "OCEAN"}
-    # stored state reflects the merge (order-independent)
-    assert games.load_game_state(conn, 1, "wordsearch", "small", "2026-06-12")["startTime"] == 50
+    # stored state reflects the merge (order-independent): most banked time wins
+    assert games.load_game_state(conn, 1, "wordsearch", "small", "2026-06-12")["played"] == 100
 
 
 # --- derived stats ---
@@ -96,15 +98,15 @@ def test_game_state_api_roundtrip(tmp_path, monkeypatch):
     # signed out → no sync, echoes the posted state and GET sees nothing stored
     anon = TestClient(app)
     body = {"game": "wordsearch", "variant": "small", "date": "2026-06-12",
-            "state": {"foundWords": [_find("BEACH", 0)], "startTime": 9}}
+            "state": {"foundWords": [_find("BEACH", 0)], "played": 9}}
     assert anon.put("/api/games/state", json=body).json()["state"]["foundWords"][0]["word"] == "BEACH"
     assert anon.get("/api/games/state?game=wordsearch&variant=small&date=2026-06-12").json()["state"] is None
     # signed in: push from "device A", then "device B" → server returns the union
     tc = _signin(app, api, "p@x.com")
     tc.put("/api/games/state", json=body)
-    bodyB = {**body, "state": {"foundWords": [_find("OCEAN", 1)], "startTime": 4}}
+    bodyB = {**body, "state": {"foundWords": [_find("OCEAN", 1)], "played": 4}}
     merged = tc.put("/api/games/state", json=bodyB).json()["state"]
-    assert {f["word"] for f in merged["foundWords"]} == {"BEACH", "OCEAN"} and merged["startTime"] == 4
+    assert {f["word"] for f in merged["foundWords"]} == {"BEACH", "OCEAN"} and merged["played"] == 9
     # GET returns the stored merge; unknown game → 404; bad date → 400
     got = tc.get("/api/games/state?game=wordsearch&variant=small&date=2026-06-12").json()["state"]
     assert {f["word"] for f in got["foundWords"]} == {"BEACH", "OCEAN"}
@@ -123,5 +125,9 @@ def test_sanitizers_reject_junk(conn):
         "foundWords": [_find("BEACH", 0),                         # ok
                        {"word": "CAT", "cells": [[0, 0], [0, 1], [0, 2]]},   # too short (<4)
                        {"word": "OCEAN", "cells": [[1, 0], [1, 1]]}],        # cells != len
-        "ms": 12345})
+        "ms": 12345, "played": -5})
     assert [f["word"] for f in ws["foundWords"]] == ["BEACH"] and ws["ms"] == 0
+    assert ws["played"] == 0  # negative junk clamped
+    # absurd active-time claims are capped at a day
+    capped = games._sanitize_wordsearch(conn, "small", "2026-06-12", {"foundWords": [], "played": 10**12})
+    assert capped["played"] == 86_400_000