stacks/miniflux: self-hosted RSS reader + News group on homepage

Adds Miniflux on ana-docker as the unified inbox for tech blogs,
Hacker News, lobste.rs, and selected subreddits. Reddit serves clean
RSS for any sub at https://reddit.com/r/<sub>/.rss, so subreddit
follows fold into the same inbox as everything else — no Reddit
account needed, no manual polling.

Stack:
  stacks/miniflux/
    compose.yaml          — miniflux + bundled postgres:16
    .env.example          — placeholders for DB password + admin user
    starter-feeds.opml    — initial subscriptions (HN, Lobste.rs,
                            r/selfhosted, r/homelab, r/LocalLLaMA, r/nba)
    README.md             — deploy / OPML import / r/nba spoiler
                            block-list / backup / update flow

Postgres bundled with the stack (not pfi-postgres) — single-user RSS
DB is tiny and the bundle keeps the dependency graph flat.

Homepage gets a new 'News' group at the TOP of the Main tab (above
Monitoring) so the Miniflux card sits prominently. The card itself
auto-discovers via the homepage.* labels on the miniflux container.

Per-feed block-list rule for r/nba documented in README — Reddit's
RSS titles for game threads include scores ("Lakers 108 - Warriors
102 [Final]") which spoil the game; a regex catches the score
patterns and skips those entries while keeping discussion/highlights.

Deploy:
  scripts/elway ana-docker --playbook playbooks/deploy-miniflux.yaml

Then edit /opt/docker/compose/miniflux/.env on the host to fill in
the two CHANGE_ME passwords and `docker compose up -d` again.

stacks/miniflux/compose.yaml

@@ -0,0 +1,85 @@
+# Miniflux — minimal self-hosted RSS reader (Go single-binary, ~30 MB image).
+# Apache 2.0. https://miniflux.app/
+#
+# Use case: unified inbox across tech blogs, Hacker News, lobste.rs,
+# and selected subreddits (Reddit serves an .rss feed for any sub at
+# https://reddit.com/r/<sub>/.rss). Subreddits with score-spoiler
+# headlines (e.g. r/nba) get a per-feed block-list rule — see README.
+#
+# Architecture: this stack bundles its own Postgres rather than using
+# the shared pfi-postgres at 10.250.50.80. Single-user RSS DB is tiny
+# (~MB scale per year) and the bundle reduces cross-host coupling.
+# Backup: postgres data lives in the named volume miniflux-db-data;
+# capture via `docker exec miniflux-db pg_dump -U miniflux miniflux`
+# in restic's pre-backup hook (separate stack — TODO).
+#
+# All tunables live in .env — edit that, not this file.
+
+services:
+  miniflux:
+    image: miniflux/miniflux:${MINIFLUX_VERSION}
+    container_name: miniflux
+    restart: unless-stopped
+    depends_on:
+      miniflux-db:
+        condition: service_healthy
+    ports:
+      - "${MINIFLUX_BIND:-0.0.0.0}:${MINIFLUX_PORT}:8080"
+    environment:
+      - DATABASE_URL=postgres://miniflux:${MINIFLUX_DB_PASSWORD}@miniflux-db/miniflux?sslmode=disable
+      - RUN_MIGRATIONS=1
+      - CREATE_ADMIN=1
+      - ADMIN_USERNAME=${MINIFLUX_ADMIN_USERNAME}
+      - ADMIN_PASSWORD=${MINIFLUX_ADMIN_PASSWORD}
+      - LOG_LEVEL=${MINIFLUX_LOG_LEVEL:-info}
+      - HTTPS=0
+      - LISTEN_ADDR=0.0.0.0:8080
+    healthcheck:
+      # Miniflux ships with a built-in healthcheck command.
+      test: ["CMD", "/usr/bin/miniflux", "-healthcheck", "auto"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 30s
+    networks:
+      - miniflux-net
+      - tnet
+    labels:
+      - homepage.group=News
+      - homepage.name=Miniflux
+      - homepage.icon=mdi-rss
+      - homepage.description=RSS reader (subreddits, blogs, HN)
+      - homepage.href=http://10.250.50.70:${MINIFLUX_PORT}
+
+  miniflux-db:
+    image: postgres:16
+    container_name: miniflux-db
+    restart: unless-stopped
+    environment:
+      - POSTGRES_USER=miniflux
+      - POSTGRES_PASSWORD=${MINIFLUX_DB_PASSWORD}
+      - POSTGRES_DB=miniflux
+      - POSTGRES_INITDB_ARGS=--encoding=UTF-8 --lc-collate=C --lc-ctype=C
+    volumes:
+      - miniflux-db-data:/var/lib/postgresql/data
+    networks:
+      - miniflux-net
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U miniflux"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+volumes:
+  miniflux-db-data:
+
+networks:
+  # Internal — only miniflux talks to miniflux-db. DB is not on tnet
+  # so it's not reachable from elsewhere on traefik-net.
+  miniflux-net:
+    name: miniflux-net
+  # Shared external — homepage's docker auto-discovery scans this
+  # network for the homepage.* labels above.
+  tnet:
+    name: traefik-net
+    external: true