refactor: move KV repositories to infrastructure (Track P — points 2, 6c)

Make the domain stop depending on infrastructure ("imports point inward").

- Point 2: relocate the four KV adapters (FeedRepository, IconRepository,
  WebSubSubscriptionRepository, CountersRepository) from domain/ to
  infrastructure/, where the logger import is legitimate. The domain now keeps
  only the pure key schema (feed-keys.ts), the Feed aggregate and value objects;
  it imports nothing outward. Deliberately no hand-rolled 24-method port
  interface (YAGNI without DI) — relocation alone fixes the direction.
- Point 6c: EmailParser.extractFeedId now returns a validated FeedId value
  object instead of a raw string, so the most untrusted input (an inbound
  recipient address) is guarded at the parse boundary and no longer round-trips
  through FeedId.fromTrusted in the ingest path.

All import paths updated; CLAUDE.md source layout/KV-schema notes updated.
351 tests pass; tsc --noEmit clean.

Co-Authored-By: Claude Opus 4.7 <[email protected]>

src/application/email-processor.ts

@@ -8,9 +8,8 @@ import {
 } from "../infrastructure/favicon-fetcher";
 import { parseOneClickUnsubscribe } from "../infrastructure/unsubscribe";
 import { getAttachmentBucket } from "../infrastructure/attachments";
-import { FeedRepository } from "../domain/feed-repository";
+import { FeedRepository } from "../infrastructure/feed-repository";
 import { Feed } from "../domain/feed.aggregate";
-import { FeedId } from "../domain/value-objects/feed-id";
 import { logger } from "../infrastructure/logger";
 import { FEED_MAX_BYTES } from "../config/constants";
 
@@ -85,18 +84,18 @@ async function loadAcceptingFeed(
     return { ok: false, reason: "invalid_address" };
   }
 
-  const feed = await FeedRepository.from(env).load(FeedId.fromTrusted(feedId));
+  const feed = await FeedRepository.from(env).load(feedId);
   if (!feed) {
-    logger.error("Feed not found", { feedId });
+    logger.error("Feed not found", { feedId: feedId.value });
     return { ok: false, reason: "feed_not_found" };
   }
   if (feed.isExpired()) {
-    logger.warn("Rejected email: feed expired", { feedId });
+    logger.warn("Rejected email: feed expired", { feedId: feedId.value });
     return { ok: false, reason: "feed_expired" };
   }
   if (feed.accepts(input.senders) === "blocked") {
     logger.warn("Rejected email: sender filter", {
-      feedId,
+      feedId: feedId.value,
       senders: input.senders,
       allowedSenders: feed.config.allowed_senders,
       blockedSenders: feed.config.blocked_senders,

src/application/feed-fetcher.ts

@@ -1,6 +1,6 @@
 import { Env, FeedConfig, EmailData } from "../types";
 import { MAX_FEED_ITEMS } from "../config/constants";
-import { FeedRepository } from "../domain/feed-repository";
+import { FeedRepository } from "../infrastructure/feed-repository";
 import { FeedId } from "../domain/value-objects/feed-id";
 
 export interface FeedData {

src/application/feed-service.ts

@@ -4,7 +4,7 @@ import { bumpCounters } from "../application/stats";
 import { waitUntilSafe } from "../infrastructure/worker";
 import { sendUnsubscribes } from "../infrastructure/unsubscribe";
 import { getAttachmentBucket } from "../infrastructure/attachments";
-import { FeedRepository } from "../domain/feed-repository";
+import { FeedRepository } from "../infrastructure/feed-repository";
 import { FeedId } from "../domain/value-objects/feed-id";
 import {
   Feed,

src/application/stats.ts

@@ -1,8 +1,8 @@
 import { Counters, Env, StatsResponse } from "../types";
 import { logger } from "../infrastructure/logger";
-import { FeedRepository } from "../domain/feed-repository";
-import { CountersRepository } from "../domain/counters-repository";
-import { WebSubSubscriptionRepository } from "../domain/websub-subscription-repository";
+import { FeedRepository } from "../infrastructure/feed-repository";
+import { CountersRepository } from "../infrastructure/counters-repository";
+import { WebSubSubscriptionRepository } from "../infrastructure/websub-subscription-repository";
 import { FeedId } from "../domain/value-objects/feed-id";
 import { getAttachmentBucket } from "../infrastructure/attachments";