User config to validated Settings. No IO: the environment is passed in.

Config arrives flattened from the manifest's `:addon/config` and the host's
runtime config. A feed may be written as a bare URL or as
`{:feed/url .. :feed/id .. :feed/tags [..]}`; keys may be keywords or the
strings a JSON config carries ("rss/feeds", "url", "id").

Feed credentials. Pure: the environment is passed in.

`:feed/auth` config forms (string keys accepted too):
  {:secret-env "HIVE_STORE_KEY"}                 Basic, key from the environment
  {:secret "hv_live_..." :username "me"}         Basic, key inline
  {:scheme "bearer" :secret-env "FEED_TOKEN"}    Bearer
A URL carrying `user:secret@` yields a Basic credential and loses the
userinfo. The secret reaches the wire only through `authorization`.

A feed item as a hive memory entry, and as an ingestion document. Pure.

Feed XML to data: RSS 2.0, RSS 1.0 (RDF) and Atom 1.0. No IO.

The document is read by the JDK's DOM parser with DOCTYPEs refused, so an
entity declaration (billion laughs, external entities) cannot be expanded.

When a feed is due, and which of its items are new. No IO, no clock: the
caller passes `now` in epoch seconds.

The scheduler does not sleep a whole period between polls. It ticks often
and asks `due?` of each feed against the time of that feed's last poll, which
is persisted. A restart, a suspended laptop or a slow poll therefore never
skips a day, and never polls a feed more often than the configured rate.