KOL feeds: fix dead/blocked sources, drop stale feeds (29→25)

Feed-health pass over KOL_FEEDS:
- raoulpal: stale Substack (last 2024-05) → Real Vision podcast feed
- dampedspring: paywalled (0 entries) → free "Damped Spring 101" Substack
- unchained: Cloudflare 403 → canonical Megaphone podcast feed
- lynalden: Cloudflare 202 → FeedBurner mirror
- glassnode: recovered via httpx http2=True (was 403 on HTTP/1.1)
- browser User-Agent + Accept headers on feed fetch
- removed dead feeds with no active replacement: placeholder,
  dragonfly, niccarter, eugene
- pin h2==4.3.0 (required by http2=True)

All 25 remaining feeds verified fetching real body content; newest
post per feed ≤88d. Bundles in-flight KOL-module work already in the
working tree (kol_x ingest, migration 027, tests).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/services/telegram.py

@@ -22,6 +22,7 @@ Source → user-toggle mapping:
 from __future__ import annotations
 
 import asyncio
+import html
 import logging
 from datetime import datetime, timezone
 from typing import Optional
@@ -100,13 +101,21 @@ def format_post(post: Post) -> str:
     asset = post.target_asset or "?"
     conf = post.ai_confidence or 0
 
-    # Heading: emoji + asset + direction + confidence
-    head = f"{emoji} <b>{asset} · {sig}</b>  ·  conf <b>{conf}</b>"
+    # Heading: emoji + asset + direction + confidence.
+    # asset comes from post.target_asset (scanner-written) — escape defensively;
+    # sig/conf/src are controlled enums/ints/labels.
+    head = f"{emoji} <b>{html.escape(asset)} · {sig}</b>  ·  conf <b>{conf}</b>"
     sub = f"<i>{src}</i>"
 
+    # Truncate the RAW text first, THEN escape — escaping first could let a
+    # 5-char entity (&amp;) get sliced mid-sequence by the length cap.
     body = (post.text or "").strip()
     if len(body) > 600:
         body = body[:600].rstrip() + "…"
+    # parse_mode=HTML: Trump posts routinely contain & < > ("Law & Order").
+    # Without escaping, Telegram rejects the whole message (400 can't parse
+    # entities) and every subscriber silently misses the alert.
+    body = html.escape(body)
 
     # Move size hint if present (BTC bottom & funding emit expected_move_pct)
     extra = ""
@@ -157,6 +166,7 @@ def format_trump_mention(post: Post) -> str:
     body = (post.text or "").strip()
     if len(body) > 300:
         body = body[:300].rstrip() + "…"
+    body = html.escape(body)  # see format_post — escape user text for HTML mode
 
     fe = (settings.frontend_url or "").rstrip("/")
     link = f'\n\n<a href="{fe}/en/trump">→ view on TrumpAlpha</a>' if fe else ""
@@ -197,7 +207,7 @@ def format_public_post(post: Post) -> str:
     else:
         conf_label = "—"
 
-    head = f"{emoji} <b>{asset} · {sig}</b>  ·  conf <b>{conf_label}</b>"
+    head = f"{emoji} <b>{html.escape(asset)} · {sig}</b>  ·  conf <b>{conf_label}</b>"
     sub = f"<i>{src}</i>"
 
     body = (post.text or "").strip()
@@ -212,6 +222,10 @@ def format_public_post(post: Post) -> str:
             reason = reason[:200].rstrip() + "…"
         body = reason
 
+    # Escape AFTER choosing text-vs-reason — both are user/AI content going
+    # into an HTML-parse-mode message. (See format_post.)
+    body = html.escape(body)
+
     fe = (settings.frontend_url or "").rstrip("/")
     link = ""
     if fe:
@@ -447,6 +461,13 @@ async def _dispatch(post_id: int) -> None:
                                post_id, channel_id)
 
 
+# Strong references to in-flight dispatch tasks. asyncio.create_task() only
+# keeps a WEAK reference, so a fire-and-forget task can be garbage-collected
+# mid-await — "Task was destroyed but it is pending!" — silently dropping a
+# subscriber fan-out. We hold the task until it completes, then auto-discard.
+_dispatch_tasks: set[asyncio.Task] = set()
+
+
 def notify_signal(post: Post) -> None:
     """Fire-and-forget. Schedules `_dispatch(post.id)` on the running loop
     and returns immediately. Safe to call from any async context — falls
@@ -459,7 +480,9 @@ def notify_signal(post: Post) -> None:
     if not post or not post.id:
         return
     try:
-        asyncio.create_task(_dispatch(post.id))
+        task = asyncio.create_task(_dispatch(post.id))
+        _dispatch_tasks.add(task)
+        task.add_done_callback(_dispatch_tasks.discard)
     except RuntimeError:
         # No running loop — extremely unusual in our FastAPI context.
         logger.warning("notify_signal: no running event loop, skipping post=%s", post.id)