refactor: tighten DDD boundaries on the Feed aggregate

Address five modeling tensions in one pass:

- Encapsulation: the Feed aggregate no longer exposes raw config/metadata
  (a shallow Readonly still leaked mutable arrays). It now offers
  intention-revealing accessors that return copies, plus
  toConfigSnapshot/toMetadataSnapshot for the repository and summary() for
  the global registry.
- feeds:list consistency: FeedRepository.save/saveConfig upsert the registry
  entry from feed.summary(), so services no longer mirror title/description/
  expiry by hand (the old add/updateInList footgun is gone).
- domain/feed.ts: drop the dead applySenderPolicy, internalise resolveExpiresAt
  and trimToByteBudget into the aggregate; feed.ts keeps only the shared
  isExpired predicate used by the read-model routes.
- Single edit path: remove editDetails; edit(patch, deps) is the sole config
  mutation, with a systematic expired guard. Renaming an expired feed now 403s.
- FeedId flows through the application and infrastructure signatures;
  fromTrusted/parse happen once at the edge, .value only at the serialisation
  boundaries (urls, feed-generator, feed-keys, logs, JSON).

347 tests green, tsc clean, Worker bundle builds.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/routes/admin/emails.tsx

@@ -699,7 +699,7 @@ emailsRouter.post("/feeds/:feedId/emails/bulk-delete", async (c) => {
         : c.text("Feed not found", 404);
     }
 
-    const allowedKeys = new Set(feed.metadata.emails.map((email) => email.key));
+    const allowedKeys = new Set(feed.emails.map((email) => email.key));
 
     if (wantsJson) {
       const body = (await c.req.json().catch(() => null)) as {
@@ -729,7 +729,7 @@ emailsRouter.post("/feeds/:feedId/emails/bulk-delete", async (c) => {
 
       const { ok: deletedOk, failed: failedEmailKeys } =
         await deleteKeysWithConcurrency(emailStorage, candidates, 35);
-      await deleteAttachmentsForEmails(env, feed.metadata.emails, candidates);
+      await deleteAttachmentsForEmails(env, feed.emails, candidates);
 
       feed.removeEmails(deletedOk);
       await repo.saveMetadata(feed);
@@ -757,7 +757,7 @@ emailsRouter.post("/feeds/:feedId/emails/bulk-delete", async (c) => {
       candidates,
       35,
     );
-    await deleteAttachmentsForEmails(env, feed.metadata.emails, candidates);
+    await deleteAttachmentsForEmails(env, feed.emails, candidates);
 
     feed.removeEmails(deletedOk);
     await repo.saveMetadata(feed);

src/routes/admin/feeds.tsx

@@ -335,7 +335,7 @@ feedsRouter.post("/:feedId/edit", async (c) => {
       blockedSenders,
     });
 
-    const result = await editFeed(env, feedId, {
+    const result = await editFeed(env, FeedId.fromTrusted(feedId), {
       title: parsedData.title,
       description: parsedData.description,
       language: parsedData.language,
@@ -422,7 +422,9 @@ feedsRouter.post("/:feedId/delete", async (c) => {
   const wantsJson = (c.req.header("Accept") || "").includes("application/json");
 
   try {
-    await deleteFeedRecord(env, feedId, (p) => waitUntilSafe(c, p));
+    await deleteFeedRecord(env, FeedId.fromTrusted(feedId), (p) =>
+      waitUntilSafe(c, p),
+    );
 
     if (wantsJson) {
       return c.json({ ok: true, feedId });
@@ -456,11 +458,15 @@ feedsRouter.post("/:feedId/purge", async (c) => {
       ? Number(body?.limit)
       : 100;
 
-    const step = await purgeFeedKeysStep(emailStorage, feedId, {
-      cursor,
-      limit,
-      bucket: getAttachmentBucket(env),
-    });
+    const step = await purgeFeedKeysStep(
+      emailStorage,
+      FeedId.fromTrusted(feedId),
+      {
+        cursor,
+        limit,
+        bucket: getAttachmentBucket(env),
+      },
+    );
 
     return c.json({
       ok: step.failedKeys.length === 0,
@@ -516,9 +522,10 @@ feedsRouter.post("/bulk-delete", async (c) => {
 
       for (const feedId of parsedFeedIds) {
         try {
+          const id = FeedId.fromTrusted(feedId);
           // Read unsubscribe URLs before the feed metadata is deleted.
-          const urls = await collectUnsubscribeUrls(emailStorage, feedId);
-          const result = await deleteFeedFastDetailed(emailStorage, feedId);
+          const urls = await collectUnsubscribeUrls(emailStorage, id);
+          const result = await deleteFeedFastDetailed(emailStorage, id);
           if (!result.ok) {
             failures.push({
               feedId,
@@ -599,9 +606,10 @@ feedsRouter.post("/bulk-delete", async (c) => {
 
     for (const feedId of parsedFeedIds) {
       try {
+        const id = FeedId.fromTrusted(feedId);
         // Read unsubscribe URLs before the feed metadata is deleted.
-        const urls = await collectUnsubscribeUrls(emailStorage, feedId);
-        const result = await deleteFeedFastDetailed(emailStorage, feedId);
+        const urls = await collectUnsubscribeUrls(emailStorage, id);
+        const result = await deleteFeedFastDetailed(emailStorage, id);
         if (result.ok) {
           unsubscribeUrls.push(...urls);
           okIds.push(feedId);