Support agent-managed X sources with TweetClaw

[kriptoburak]

需求理解 / Requirement Understanding

我理解的需求是：
ClawFeed's current server stores source definitions and finished digests, but it does not collect X content. This change lets an OpenClaw agent administer sources with the existing server API key, collect reviewed public X items through optional TweetClaw reads, and submit the finished digest without adding social-account writes to ClawFeed.

原始指令/Issue：
Fixes #35. Issue #37 also documents why configured Twitter sources need an external collector on the current architecture.

---

Summary

• Allows the existing API_KEY to resolve, list, create, update, read, and soft-delete sources without Google OAuth.
• Serializes object-shaped source config on both create and update, while API-key-created sources remain unowned and private by default.
• Replaces the former packet-only recipe with a complete OpenClaw + TweetClaw workflow for reviewed public X reads and digest submission.
• Separates ClawFeed and Xquik credentials, documents paid-read approval and untrusted-content boundaries, and excludes social writes.
• Makes E2E defaults local-only, uses data/test.db, and rejects non-loopback targets unless explicitly allowed.
• Adds 9 API-key regression assertions and aligns the test documentation with the verified 75-test suite.

Type

• Feature
• Bug fix
• Refactor
• CI / DevOps
• Docs

Test plan

• npm ci under Node.js 20.20.2, matching CI
• npm run lint with 0 errors and 5 pre-existing warnings
• Local CI-shaped server run: 75/75 E2E assertions passed
• Remote-target guard rejects both ordinary and user-info-shaped remote URLs with exit code 2
• shellcheck test/e2e.sh test/setup.sh test/teardown.sh
• bash -n test/e2e.sh test/setup.sh test/teardown.sh
• node --check src/server.mjs && node --check src/db.mjs
• npm audit --omit=dev reports 0 vulnerabilities
• Git whitespace, conflict-marker, public-link, and package-metadata checks

The host's default Node.js 26 runtime cannot compile this repository's pinned better-sqlite3@11.10.0. The clean install and all runtime checks were rerun successfully under the repository's Node.js 20 CI version without changing dependencies.

Checklist

• No secrets or credentials committed
• No console.log added to production code
• Regression coverage added for each new authorization and serialization branch
• No breaking API changes

[kriptoburak]

I rebuilt this PR from current main after checking ClawFeed's source and digest boundaries. The previous packet-only documentation did not connect to an executable collector in the current server.

Commit 02cf83c now fixes #35 with API-key source administration, preserves object-shaped source config, documents the complete optional TweetClaw read workflow, and makes the destructive E2E defaults local-only. The Node.js 20 CI-shaped run passes all 75 assertions; lint has 0 errors and only the 5 existing warnings. The commit is signed and GitHub-verified.