Harden paper dispatch reliability, sources, and operations

[Looperswag]

Summary

• harden ingestion, canonical identity, ranking, delivery outbox, alerts, and scheduler recovery
• add ACL and OpenAlex plus bounded first-party research blogs; document intentionally inactive sources
• secure the private Web reader and annotation re-anchoring
• simplify onboarding and add monitoring, backup, privacy, launchd, CI, and opt-in cloud scheduling docs

Verification

• Root: 54 files, 492 tests; 85.45% statement coverage
• Web: 44 files, 702 tests; 90.37% statement coverage
• Playwright: 10/10
• Pipeline pgTAP: 60/60; full DB migration, upgrade, permissions, concurrency, and lint gate passed
• Clean npm installs and production dependency audits: 0 vulnerabilities
• Public dry canary: 94 fresh deduplicated candidates

Activation boundary

Production Supabase/Web, independent alert receipt, authenticated OpenAlex, and LaunchAgent acceptance remain credential or machine configuration steps. The cloud ingest workflow is disabled unless the repository variable is explicitly enabled.