Extend Omarchy News (RSS Feeds)

[tcballard]

#10012 adds a focused reader for the official Omarchy news feed. A useful follow-up would let people add other formal RSS sources without weakening that default or turning the current PR into a general feed-reader project.

A concrete example is BBC News.

Proposal

Keep Omarchy News pinned and enabled by default, then allow optional RSS sources alongside it.

The reader could support:

• All plus individual source filters
• Source name, icon and colour
• Separate unread and cached state per source
• Independent refresh failures, backoff and last-updated status
• The existing two-pane reader, keyboard navigation and safe article links
• OPML import and export later

The current two-pane layout should remain. Source filters can sit above the feed rather than adding a third permanent column.

Safety and publisher boundaries

Supporting arbitrary URLs requires a broader security model than #10012:

• Require HTTPS
• Block loopback, private-network and link-local destinations
• Revalidate redirects and DNS results
• Retain strict response, timeout, item and content limits
• Keep markup sanitisation and safe HTTP(S) links
• Send no cookies or credentials
• Isolate failures so one bad feed cannot block the others
• Display only content supplied by the RSS feed and link back to the publisher
• Respect each publisher’s RSS usage terms

MVP acceptance criteria

• Users can add, disable and remove an HTTPS RSS source.
• Omarchy remains the default source and cannot be silently replaced.
• Headlines can be viewed across all feeds or filtered by source.
• Read/unread and cache state are tracked per source.
• A failed or malformed feed does not affect other sources.
• Redirect, SSRF, size-limit and unsafe-markup cases have automated coverage.

Non-goals

• Authenticated or private feeds
• Podcast and media-enclosure playback
• Cross-device read-state synchronisation
• Scraping article pages beyond the RSS payload

This should be implemented separately from #10012 after the official-feed reader has settled.