news-digest: multi-tenant deploy + masthead overlap fix

Two pieces:

1) Multi-tenant onboarding via scripts/add-digest-user.sh

   Shared miniflux + per-user digest stack. Onboarding a teammate
   takes one command (plus a one-time sudo for dir creation):

     scripts/add-digest-user.sh <username>

   What the script does:
     - Reads miniflux admin creds from ana-docker
     - Allocates next free port (scans existing digest-*/.env)
     - Generates a random password (or accepts one as 2nd arg)
     - Creates the miniflux user via the admin API
     - Materializes a per-user .env at /opt/docker/compose/digest-<user>/
       (inherits NEWS_DIGEST_TAG from the canonical stack so all
       tenants run the same image)
     - Brings up `docker compose -p digest-<user> up -d`
     - Seeds default world/local feeds in the new user's miniflux
     - Triggers a first digest run

   compose.yaml now uses ${DIGEST_PROJECT:-news-digest} to namespace
   container_name + homepage labels. Default keeps backward-compat
   for the singleton install — existing stacks unaffected.

2) Masthead overlap on phone widths

   Desktop CSS pinned .masthead-edition to grid-row 1, which collided
   with .masthead-brand once the mobile media query collapsed both
   to grid-column 1. Result: "MORNING EDITION" badge stacked on top
   of the "DAILY DIGEST" hero. Reset grid-row to `auto` for all
   three masthead children in the ≤720 px breakpoint so they
   auto-flow vertically.

stacks/news-digest/.env.example

@@ -64,3 +64,12 @@ DIGEST_MINIFLUX_HEADLINES_MAX=15
 # Separate from /opt/docker/conf/<stack>/ to keep generated content
 # distinct from config. Owned by container UID; writes are atomic.
 NEWS_DIGEST_OUTPUT_DIR=/opt/docker/data/news-digest
+
+# ── multi-tenant (optional) ──────────────────────────────────────────
+# Per-user instances are deployed via scripts/add-digest-user.sh, which
+# materializes a per-user .env and sets DIGEST_PROJECT to namespace
+# container names + homepage labels. Leave unset for the singleton
+# install — defaults preserve the original "news-digest" naming.
+# DIGEST_PROJECT=digest-alice
+# DIGEST_HOMEPAGE_NAME=Alice's Digest
+# DIGEST_HOMEPAGE_DESC=Personal news brief for Alice