af_fulltext: rule-driven extraction with a pluggable renderer

Replaces subscribing feeds through a self-hosted Full-Text RSS proxy. Feed URLs
go back to being real feed URLs and extraction happens inside tt-rss, using the
same ftr-site-config rules the proxy used.

The engine in lib/ has no tt-rss dependencies, so rules can be developed and
audited from the command line; init.php is a thin adapter over it.

Two findings from measuring the real subscription first, both of which shaped
the design:

- Firecrawl's own onlyMainContent is far too coarse to extract with (73KB of
  chrome on a Cloudflare post), but it is an excellent renderer. So it is used
  for rawHtml only and the rule engine does the extraction.
- A body rule that stops matching after a redesign falls through to Readability
  and still produces a plausible article, so the breakage is invisible. Every
  extraction now records which rule matched and whether it fell back; auditing
  the 34 live feeds surfaced five community rules that match nothing.

Custom rules included for the sites that needed them, including three comics
where the article is an image and text-scoring extractors return the wrong thing
or nothing at all.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011sSJdftQx5bW5HZHgUKF3i

lib/TtrssFetcher.php

@@ -0,0 +1,48 @@
+<?php
+namespace AfFulltext;
+
+/**
+ * The `direct` backend inside tt-rss.
+ *
+ * Deliberately goes through UrlHelper rather than cURL directly, so article
+ * fetches keep tt-rss's own SSRF protection (UrlHelper::validate refuses private
+ * and link-local addresses). Feeds are attacker-influenced input; a plugin that
+ * fetches whatever a feed points at must not be the hole in that.
+ *
+ * FirecrawlFetcher is the deliberate exception -- it talks to one operator-configured
+ * in-cluster endpoint, which UrlHelper would refuse precisely because it is private.
+ */
+final class TtrssFetcher implements Fetcher {
+	public function __construct(private readonly int $timeout = 20) {}
+
+	public function name(): string { return 'direct'; }
+
+	public function fetch(string $url, array $headers = []): FetchResult {
+		if (!class_exists('\UrlHelper'))
+			return new FetchResult(error: 'UrlHelper unavailable (not running inside tt-rss)');
+
+		$options = [
+			'url' => $url,
+			'http_accept' => 'text/*',
+			'type' => 'text/html',
+			'timeout' => $this->timeout,
+		];
+
+		// Site configs routinely set a user-agent to get the article rather than a
+		// consent wall; UrlHelper takes it as a first-class option.
+		if (isset($headers['user-agent'])) $options['useragent'] = $headers['user-agent'];
+
+		$body = \UrlHelper::fetch($options);
+
+		if (!is_string($body) || $body === '') {
+			$error = \UrlHelper::$fetch_last_error ?: 'fetch returned nothing';
+			return new FetchResult(error: $error, status: (int) \UrlHelper::$fetch_last_error_code);
+		}
+
+		return new FetchResult(
+			html: $body,
+			effective_url: \UrlHelper::$fetch_effective_url ?: $url,
+			status: 200,
+		);
+	}
+}