p1: /v2/scrape, /v1/fetch, auth, CLI, contract tests

Single Fetcher.Fetch on the Guard that holds DenyPrefixes. skipTlsVerification
is ignored. No 502. keys add writes the secret only to --out. Release binary
has no -test-allow-prefix.

go.mod

@@ -1,3 +1,21 @@
 module git.wntrmute.dev/kyle/sift
 
-go 1.24
+go 1.26.0
+
+require (
+	github.com/JohannesKaufmann/html-to-markdown/v2 v2.5.2
+	github.com/go-shiori/go-readability v0.0.0-20251205110129-5db1dc9836f0
+	github.com/itchyny/gojq v0.12.19
+	github.com/pelletier/go-toml/v2 v2.4.3
+	golang.org/x/net v0.59.0
+)
+
+require (
+	github.com/JohannesKaufmann/dom v0.3.1 // indirect
+	github.com/andybalholm/cascadia v1.3.4 // indirect
+	github.com/araddon/dateparse v0.0.0-20210429162001-6b43995a97de // indirect
+	github.com/go-shiori/dom v0.0.0-20230515143342-73569d674e1c // indirect
+	github.com/gogs/chardet v0.0.0-20211120154057-b7413eaefb8f // indirect
+	github.com/itchyny/timefmt-go v0.1.8 // indirect
+	golang.org/x/text v0.42.0 // indirect
+)