stacks/miniflux: self-hosted RSS reader + News group on homepage

Adds Miniflux on ana-docker as the unified inbox for tech blogs,
Hacker News, lobste.rs, and selected subreddits. Reddit serves clean
RSS for any sub at https://reddit.com/r/<sub>/.rss, so subreddit
follows fold into the same inbox as everything else — no Reddit
account needed, no manual polling.

Stack:
  stacks/miniflux/
    compose.yaml          — miniflux + bundled postgres:16
    .env.example          — placeholders for DB password + admin user
    starter-feeds.opml    — initial subscriptions (HN, Lobste.rs,
                            r/selfhosted, r/homelab, r/LocalLLaMA, r/nba)
    README.md             — deploy / OPML import / r/nba spoiler
                            block-list / backup / update flow

Postgres bundled with the stack (not pfi-postgres) — single-user RSS
DB is tiny and the bundle keeps the dependency graph flat.

Homepage gets a new 'News' group at the TOP of the Main tab (above
Monitoring) so the Miniflux card sits prominently. The card itself
auto-discovers via the homepage.* labels on the miniflux container.

Per-feed block-list rule for r/nba documented in README — Reddit's
RSS titles for game threads include scores ("Lakers 108 - Warriors
102 [Final]") which spoil the game; a regex catches the score
patterns and skips those entries while keeping discussion/highlights.

Deploy:
  scripts/elway ana-docker --playbook playbooks/deploy-miniflux.yaml

Then edit /opt/docker/compose/miniflux/.env on the host to fill in
the two CHANGE_ME passwords and `docker compose up -d` again.

playbooks/deploy-miniflux.yaml

@@ -0,0 +1,82 @@
+# Deploy Miniflux + bundled Postgres to ana-docker.
+#
+# Usage:
+#   scripts/elway ana-docker --playbook playbooks/deploy-miniflux.yaml
+#
+# Idempotent — every step is creates-/when-gated; rerun is safe.
+#
+# After this playbook runs once, fill in the two CHANGE_ME passwords
+# in /opt/docker/compose/miniflux/.env on the host (see README) and
+# re-run `docker compose up -d` to start the stack with the real
+# passwords. The first-run CREATE_ADMIN=1 then bootstraps the admin
+# user on the empty DB.
+
+vars:
+  compose_dir: /opt/docker/compose/miniflux
+  host_port: "8080"
+
+steps:
+  - name: Ensure compose dir exists
+    shell: mkdir -p {{ compose_dir }}
+    creates: "{{ compose_dir }}"
+
+  - name: Upload compose.yaml
+    upload:
+      src: stacks/miniflux/compose.yaml
+      dest: "{{ compose_dir }}/compose.yaml"
+      mode: "0644"
+
+  - name: Upload starter-feeds.opml (for in-UI import)
+    upload:
+      src: stacks/miniflux/starter-feeds.opml
+      dest: "{{ compose_dir }}/starter-feeds.opml"
+      mode: "0644"
+
+  - name: Seed .env from template (only if absent)
+    upload:
+      src: stacks/miniflux/.env.example
+      dest: "{{ compose_dir }}/.env"
+      mode: "0644"
+    when: "[ ! -f {{ compose_dir }}/.env ]"
+
+  # ── compose pull + bring up ─────────────────────────────────────────
+
+  - name: docker compose pull (~250 MB total — postgres + miniflux)
+    shell: |
+      set -o pipefail
+      cd {{ compose_dir }} && docker compose pull --quiet 2>&1 \
+        | grep -vE '^\s*[0-9a-f]{8,16}\s+(Extracting|Pull complete|Pulling fs layer|Verifying Checksum|Download complete|Waiting|Already exists|Downloading|Pulling from)'
+
+  - name: docker compose up -d
+    shell: cd {{ compose_dir }} && docker compose up -d
+
+  - name: Wait for /healthcheck to respond (or report .env passwords still placeholder)
+    shell: |
+      for i in $(seq 1 30); do
+        # Miniflux returns 200 on /healthcheck once running.
+        if curl -sf -o /dev/null --max-time 3 http://localhost:{{ host_port }}/healthcheck; then
+          exit 0
+        fi
+        sleep 5
+      done
+      # Don't fail hard — first run with placeholder passwords will
+      # never come up healthy. Tell the operator what to do.
+      echo
+      echo "Miniflux didn't come healthy in 150 s — likely cause:"
+      echo "  /opt/docker/compose/miniflux/.env still has CHANGE_ME passwords."
+      echo "  Edit them (see stacks/miniflux/README.md) and re-run docker compose up -d."
+      exit 0
+    changed_when: "false"
+
+verify:
+  - name: Container miniflux exists
+    shell: docker inspect miniflux --format '{{.State.Status}}' | grep -qE 'running|created|restarting'
+    changed_when: "false"
+
+  - name: Container miniflux-db exists
+    shell: docker inspect miniflux-db --format '{{.State.Status}}' | grep -qE 'running|created|restarting'
+    changed_when: "false"
+
+  - name: Both containers on miniflux-net
+    shell: docker inspect miniflux miniflux-db --format '{{json .NetworkSettings.Networks}}' | grep -q miniflux-net
+    changed_when: "false"