Smarter feed polling, bug fixes, tests and NixOS module update

[Brawl345]

What's this about?

The bot now fetches feeds much more politely, handles problems better and is thoroughly tested. Along the way, several bugs were fixed, dependencies were updated and the NixOS module got a refresh.

Closes #6, closes #7 (both are included in this PR).

Fetching feeds

• Every feed has its own schedule instead of all feeds being fetched every minute. Restarting the bot no longer re-downloads everything.
• Less traffic: if a feed hasn't changed, the server only sends a short "nothing new" reply.
• Quiet feeds are checked less often (can be turned off). As soon as something new shows up, the feed is back to the normal interval.
• Easy on servers: feeds from the same server are fetched one after another, and "please slow down" requests from servers are respected.
• Moved feeds are switched to their new address automatically.
• Permanently broken feeds are disabled after a week and marked with 🚫 in /rss. Subscribing again with /sub re-enables them.
• Notices about this only go to the admin, never into channels or groups.

Everything can be tuned with the POLL_* settings and is explained in the README under "How polling works".

Bug fixes

• The Docker build was broken.
• Depending on the time zones of the server and the database, feeds were fetched far too often or too rarely.
• Fresh installs with a current MariaDB failed while setting up the database.
• When unsubscribing, a database error could cause data to be deleted by mistake.
• Umlauts and other special characters could break messages when texts were shortened.
• Several smaller fixes, e.g. for escaping, Telegram flood limits and redirects.

Security & maintenance

• Redirects from public feeds into the local network are blocked.
• Go 1.26 (Docker image uses 1.27) and all dependencies updated; Docker base images and GitHub Actions are pinned.
• CI is hardened and now runs the tests against three MariaDB versions.
• Docker images are only published from master and tags, no longer from every branch.

Custom template & NixOS

• Custom post template via POST_TEMPLATE (or post.gohtml as before).
• The NixOS module can set the template and all polling settings, works with an external database, runs hardened and has its own VM test (nix flake check).

Good to know when updating

• The database is migrated automatically on startup.
• New default polling times: feeds are fetched every 10 minutes instead of every minute, quiet feeds less often (at most every 6 hours). For faster updates: POLL_INTERVAL=1m and POLL_ADAPTIVE=false.
• MYSQL_SOCKET is now commented out in .env.example, because it overrides host, port and password. Please give existing .env files a quick check.

🤖 Generated with Claude Code

https://claude.ai/code/session_01W6fMYGug2BYBwi3P9Coyie