Browser feedback uses the signed public endpoint; add the config page

Connor pointed out he may use the site from a laptop away from home. The gated
/ui/feedback/ path was worse than just inconvenient: fetch() follows redirects,
so an expired Authelia session would go 302 -> login page -> HTTP 200, and the
UI would mark the card labelled having recorded nothing. Silent data loss on the
one signal the system learns from.

Both surfaces now post to the same HMAC-signed public endpoint, with
`redirect: 'error'` so a redirect fails loudly instead of looking like success.
The gated route is gone -- one mechanism, not two.

/config shows what every block actually matches right now, and a box to try a
filter before saving it: describe what you want caught, see what it catches and
what sits just below the line, move the threshold, then save it as a veto or a
demote. That boundary view is the point -- a crypto filter at 0.55 catches 131
clusters including "Security updates for Monday", and at 0.62 catches 4, which
you can only know by looking.

Saves use tomlkit rather than tomllib plus a dump, because profile.toml carries
the reasoning behind every constant and a comment-stripping round-trip would
quietly destroy the record of why each number is what it is. Verified: 97
top-level comment lines in, 97 out.

The config mount had to stop being :ro, and ~/config/news2 is now owned
10001:1000 group-writable so the container can save while hand-editing still
works. `:U` would have fixed the container and locked the user out.

deploy/README.md

@@ -36,7 +36,8 @@ file: `~/compose.yml.pre-news-v2`):
       # as uid 10001, not root, so without it SQLite fails with
       # "attempt to write a readonly database".
       - ./data/news2:/data:U
-      - ./config/news2:/config:ro
+      # NOT :ro -- the /config page writes back to profile.toml.
+      - ./config/news2:/config
     healthcheck:
       # NOT curl: the v0.2 image shipped none, so its healthcheck failed forever
       # while the service was fine and `podman ps` reported it unhealthy for days.
@@ -53,7 +54,9 @@ The image is tagged `localhost/news-py:latest` rather than reusing
 rollback path; the old database at `./data/news/db` is likewise untouched.
 Rolling back is a two-line edit plus `podman-compose up -d news-backend`.
 
-Config lives in `~/config/news2/` (copied from `profile/*.toml`).
+Config lives in `~/config/news2/`, owned `10001:1000` and group-writable so the
+container (uid 10001) can save from the `/config` page while you can still edit
+the files by hand. `:U` would have worked for the container and locked you out.
 
 The `caddy` service still bind-mounts `./data/news/web:/srv/news:ro`, which is
 now unused since the Caddyfile no longer serves a static SPA. Harmless; remove