feat: simplify token-gated onboarding flow

[gildesmarais]

Summary

• make the bundled config/feeds.yml read the main create-feed token from HTML2RSS_ACCESS_TOKEN
• keep config/feeds.yml authoritative for development while tightening production placeholder-token validation
• update readiness/runtime checks and first-run UI token guidance for the simpler onboarding path

Validation

• mise exec -- ruby -c app/web/api/v1/health.rb app/web/config/environment_validator.rb app/web/config/local_config.rb app/web/config/runtime_env.rb spec/html2rss/web/api/v1_spec.rb spec/html2rss/web/boot/setup_spec.rb spec/html2rss/web/environment_validator_spec.rb spec/html2rss/web/local_config_spec.rb
• npm exec eslint -- src/components/AppPanels.tsx src/__tests__/App.test.tsx
• npm exec tsc -- -p tsconfig.typecheck.json --noEmit

Notes

• Full Ruby specs were blocked locally because bundler could not materialize html2rss-0.19.1 in this workspace.
• Frontend Vitest was blocked locally by a missing optional Rollup native package in node_modules.