- Add API test layer (TestClient): bad prefs -> 200, mute affects feed,
avoid-term filters, brief filters down, counts match filtered feed.
- Render article cards via the DOM API (textContent) instead of HTML string
interpolation, and only allow http(s) hrefs — defense-in-depth XSS guard for
when the feed faces untrusted sources publicly.
- Refresh the stale README Next Steps to reflect what's done vs ahead.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
