feat: reader-rendering correctness + privacy hardening (P1·S batch)

Close the five open P1·S items from TODO.md:
- X-Robots-Tag: noindex on rss/atom/entries/files + a /robots.txt
- absolutize relative content URLs against the sender's site
- promote lazy-loaded images (data-src → src, strip loading="lazy")
- strip XML-illegal control chars from generated feeds (keep emoji)
- plain-text feed <title> (strip HTML, decode entities)

Sender-base derivation lives on the EmailAddress value object
(siteBaseUrl) instead of a misplaced favicon helper. Bump to 0.2.1
and document the changes in README + CLAUDE.md.

Co-Authored-By: Claude Opus 4.7 <[email protected]>

src/domain/value-objects/email-address.test.ts

@@ -24,4 +24,10 @@ describe("EmailAddress", () => {
     expect(EmailAddress.parse("not an email")).toBeNull();
     expect(EmailAddress.parse("")).toBeNull();
   });
+
+  it("derives the sender site base URL from the domain", () => {
+    expect(EmailAddress.parse("News <[email protected]>")?.siteBaseUrl()).toBe(
+      "https://example.com/",
+    );
+  });
 });

src/domain/value-objects/email-address.ts

@@ -20,6 +20,15 @@ export class EmailAddress {
     return new EmailAddress(`${local}@${domain.value}`, domain);
   }
 
+  /**
+   * Best-effort website origin implied by the sender's domain
+   * (e.g. `https://example.com/`). Used to absolutize relative links in the
+   * email body — the sender's site is the only base we can infer.
+   */
+  siteBaseUrl(): string {
+    return `https://${this.domain.value}/`;
+  }
+
   toString(): string {
     return this.normalized;
   }