refactor: tighten DDD boundaries on the Feed aggregate

Address five modeling tensions in one pass:

- Encapsulation: the Feed aggregate no longer exposes raw config/metadata
  (a shallow Readonly still leaked mutable arrays). It now offers
  intention-revealing accessors that return copies, plus
  toConfigSnapshot/toMetadataSnapshot for the repository and summary() for
  the global registry.
- feeds:list consistency: FeedRepository.save/saveConfig upsert the registry
  entry from feed.summary(), so services no longer mirror title/description/
  expiry by hand (the old add/updateInList footgun is gone).
- domain/feed.ts: drop the dead applySenderPolicy, internalise resolveExpiresAt
  and trimToByteBudget into the aggregate; feed.ts keeps only the shared
  isExpired predicate used by the read-model routes.
- Single edit path: remove editDetails; edit(patch, deps) is the sole config
  mutation, with a systematic expired guard. Renaming an expired feed now 403s.
- FeedId flows through the application and infrastructure signatures;
  fromTrusted/parse happen once at the edge, .value only at the serialisation
  boundaries (urls, feed-generator, feed-keys, logs, JSON).

347 tests green, tsc clean, Worker bundle builds.

Co-Authored-By: Claude Opus 4.7 <[email protected]>

src/infrastructure/websub-subscription-repository.test.ts

@@ -1,19 +1,21 @@
 import { describe, it, expect } from "vitest";
 import { createMockEnv } from "../test/setup";
 import { WebSubSubscriptionRepository } from "./websub-subscription-repository";
+import { FeedId } from "../domain/value-objects/feed-id";
 import type { Env, WebSubSubscription } from "../types";
 
 const mockEnv = () => createMockEnv() as unknown as Env;
+const fid = FeedId.fromTrusted("a.b.42");
 
 describe("WebSubSubscriptionRepository", () => {
   it("round-trips subscriptions and counts feeds with subscribers", async () => {
     const repo = new WebSubSubscriptionRepository(mockEnv().EMAIL_STORAGE);
-    expect(await repo.get("a.b.42")).toEqual([]);
+    expect(await repo.get(fid)).toEqual([]);
     const subs: WebSubSubscription[] = [
       { callbackUrl: "https://r.example/cb", expiresAt: 9999 },
     ];
-    await repo.save("a.b.42", subs);
-    expect(await repo.get("a.b.42")).toEqual(subs);
+    await repo.save(fid, subs);
+    expect(await repo.get(fid)).toEqual(subs);
     expect(await repo.countKeys()).toBe(1);
   });
 });