refactor: move KV repositories to infrastructure (Track P — points 2, 6c)

Make the domain stop depending on infrastructure ("imports point inward").

- Point 2: relocate the four KV adapters (FeedRepository, IconRepository,
  WebSubSubscriptionRepository, CountersRepository) from domain/ to
  infrastructure/, where the logger import is legitimate. The domain now keeps
  only the pure key schema (feed-keys.ts), the Feed aggregate and value objects;
  it imports nothing outward. Deliberately no hand-rolled 24-method port
  interface (YAGNI without DI) — relocation alone fixes the direction.
- Point 6c: EmailParser.extractFeedId now returns a validated FeedId value
  object instead of a raw string, so the most untrusted input (an inbound
  recipient address) is guarded at the parse boundary and no longer round-trips
  through FeedId.fromTrusted in the ingest path.

All import paths updated; CLAUDE.md source layout/KV-schema notes updated.
351 tests pass; tsc --noEmit clean.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/domain/email-parser.test.ts

@@ -3,15 +3,15 @@ import { EmailParser } from "./email-parser";
 
 describe("EmailParser.extractFeedId", () => {
   it("extracts a valid feed ID from an email address", () => {
-    expect(EmailParser.extractFeedId("river.castle.42@example.com")).toBe(
-      "river.castle.42",
-    );
+    expect(
+      EmailParser.extractFeedId("river.castle.42@example.com")?.value,
+    ).toBe("river.castle.42");
   });
 
   it("is case-insensitive for the local part", () => {
-    expect(EmailParser.extractFeedId("River.Castle.42@example.com")).toBe(
-      "River.Castle.42",
-    );
+    expect(
+      EmailParser.extractFeedId("River.Castle.42@example.com")?.value,
+    ).toBe("River.Castle.42");
   });
 
   it("returns null for an address with no feed ID format", () => {