feat: CMS-owned footer, public-site endpoints, and classifieds moderation

[ssavutu]

Moves three reader-facing things off the legacy WordPress install and into the CMS. Paired with Scalene CMS-Testing (already pushed), which consumes all of it.

Four commits, each self-contained and building on its own.

1. feat(settings) — CMS-owned footer menu

The public site's six footer columns were hardcoded, so changing a link meant editing Astro and redeploying. Stored as JSON in cms_settings, served from GET /v1/settings/footer, admin PATCH, with an editor on the settings screen.

A column is a flat ordered list of typed entries (heading / link / spacer) rather than a heading with children — the live footer stacks two bolded groups in one column ("Columns" under "Opinion", "Special Editions" under "Comics & Puzzles"), which a single-heading shape can't express.

The stored default is the footer already shipped, so an untouched install serves exactly what it served before. A save that normalizes to nothing reverts to that default — the footer can't be blanked by a bad write.

2. feat(public) — gallery, random, sitemap

Endpoint	Replaces
GET /v1/gallery	/wp-json/triangle/v1/gallery
GET /v1/articles/random	/wp-json/triangle/v1/random/
GET /v1/sitemap/slugs	/wp-json/triangle/v2/sitemap-slugs

Gallery is a separate endpoint rather than opening up /v1/media/gallery: it's unauthenticated, so it's narrowed to images (which Nginx already serves publicly off CephFS) and drops the free-text search param, which would otherwise make it a lookup tool over editors' filenames and captions. The editor-facing catalogue stays authenticated.

3. feat(classifieds) — moderation queue + signed Slack approvals

Classifieds were the last reader-facing flow on WordPress, and the Slack message was the submission — the whole classified rode along base64-encoded in the button value, so anything unclicked or scrolled past was lost with no record.

Submissions now persist as pending on arrival. Approving happens either in a CMS queue (mirroring the comments queue) or from the Slack buttons, both writing the same row and recording who decided and by which route.

Slack carries no session, so the request signature is the entire authorization story for POST /v1/integrations/slack/classifieds: verified over the raw body before anything parses it, constant-time, five-minute replay window in both directions, 1 MiB read cap. With SLACK_SIGNING_SECRET unset it returns 503 rather than falling open.

Clicking a stale message can't reverse a decision already made in the CMS. Messages from the old flow carry a base64 blob instead of a row id and are told to use the CMS.

4. feat(classifieds) — make a broken Slack integration announce itself

Slack's interactivity setup never probes the Request URL (unlike the Events API), so a wrong or unreachable URL saves cleanly and fails silently at the first click. Rejections now log as warnings naming which check failed, throttled to one a minute with suppressed events counted into the next line; the response stays a flat "invalid slack signature" so a prober learns nothing. slack_configured on the manage response lets the queue stop promising Slack approvals that can't work.

Verification

go build, go vet, go test, npm run build all clean. Exercised end to end against a local MariaDB: submit → pending → signed Slack approve → appears in the public listing; expired items excluded; bad signature 401; stale message reports the prior decision. 11 new tests. Swagger regenerated.

Deploy notes

• SLACK_SIGNING_SECRET added to .env.example, docker-compose.yml, deploy/cms.env.example, deploy/compose.cms.yml.
• The Slack buttons need Delta on public HTTPS (Slack requires a publicly-trusted cert; the nginx config is still :80). The CMS queue works regardless — nothing is blocked on it.
• Whatever consumes the Slack clicks today must be turned off at cutover, or an approval writes to both WordPress and Delta.

🤖 Generated with Claude Code