refactor(core): overhaul state transition architecture, persistent job queue, and API layer

- Implement atomic state transitions: add EntryService.PatchEntry() with EntryDiff computation and EventEntryTransition event emission.
- Add persistent SQLite task queue (JobEngine): add jobs table with crash recovery, exponential backoff retries, concurrency control, and idempotency key deduplication.
- Decompose monolithic HTTP handlers: split handlers.go into domain handlers (auth, feeds, entries, jobs, settings, rules, sse).
- Implement real-time Server-Sent Events (/api/events/stream) for multi-tab/device state synchronization.
- Fix SQLite concurrency: apply busy_timeout(10000) and journal_mode(WAL) via DSN query parameters to resolve SQLITE_BUSY (5).
- Fix AI settings & prompt loading: unmarshal JSON from ai_settings, apply configured prompt templates, and enforce strict enabled/API key validations.
- Fix undo share state: remove omitempty from ShareUUID to serialize null for state resets.
- Fix middle list counter: compute true unread/total stats from DB and clean switcher button labels.
- Adapt mobile UI for iOS: add viewport-fit=cover in index.html and calibrate safe-area insets for the bottom navigation and article reader toolbar.
- Add architectural documentation and worklog in docs/009_worklog.md.

internal/api/server.go

@@ -20,10 +20,10 @@ func NewRouter(h *Handler, authService *auth.AuthService, staticDir string) http
 	r.Use(middleware.Recoverer)
 	r.Use(middleware.Compress(5))
 
-	// CORS configuration for local development & PWA
+	// CORS configuration: Restricted to localhost dev ports and same-origin
 	r.Use(cors.Handler(cors.Options{
-		AllowedOrigins:   []string{"http://localhost:5173", "http://localhost:3000", "http://localhost:8080", "*"},
-		AllowedMethods:   []string{"GET", "POST", "PUT", "DELETE", "OPTIONS"},
+		AllowedOrigins:   []string{"http://localhost:5173", "http://localhost:3000", "http://localhost:8080"},
+		AllowedMethods:   []string{"GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"},
 		AllowedHeaders:   []string{"Accept", "Authorization", "Content-Type", "X-CSRF-Token"},
 		ExposedHeaders:   []string{"Link"},
 		AllowCredentials: true,
@@ -43,6 +43,10 @@ func NewRouter(h *Handler, authService *auth.AuthService, staticDir string) http
 		r.Group(func(r chi.Router) {
 			r.Use(authService.Middleware)
 
+			// Real-time Event Stream (K8s Watch pattern via SSE)
+			r.Get("/events/stream", h.StreamEvents)
+
+			// Auth & Profile
 			r.Get("/auth/me", h.GetMe)
 			r.Put("/auth/password", h.UpdatePassword)
 			r.Get("/user/preferences", h.GetUserPreferences)
@@ -65,15 +69,22 @@ func NewRouter(h *Handler, authService *auth.AuthService, staticDir string) http
 			// Entries
 			r.Get("/entries", h.ListEntries)
 			r.Get("/entries/{id}", h.GetEntry)
+			r.Patch("/entries/{id}", h.PatchEntry)
 			r.Put("/entries/{id}/read", h.UpdateEntryRead)
 			r.Put("/entries/{id}/star", h.UpdateEntryStar)
 			r.Post("/entries/{id}/share", h.ToggleShareEntry)
 			r.Post("/entries/{id}/ai-summary", h.GenerateAISummary)
-			r.Post("/entries/mark-all-read", h.MarkAllRead)
 			r.Post("/entries/{id}/scrape", h.ScrapeEntry)
+			r.Post("/entries/mark-all-read", h.MarkAllRead)
 			r.Get("/entries/{id}/variants", h.ListEntryVariants)
 			r.Get("/entries/{id}/variants/{key}/stream", h.GetVariantBlobStream)
 
+			// Task Queue / Background Jobs
+			r.Get("/jobs", h.ListJobs)
+			r.Get("/jobs/{id}", h.GetJob)
+			r.Post("/jobs/{id}/cancel", h.CancelJob)
+			r.Post("/jobs/{id}/retry", h.RetryJob)
+
 			// Rules
 			r.Get("/rules", h.ListRules)
 			r.Post("/rules", h.CreateRule)