Mode 'Circles' in Admin > Settings (radio + section).
Admin > Circle (admin-circle): add sources/list/status, per source
Refresh (syncOne) + Delete (cleans up orphaned cache), and a
visibility toggle (sites.allow_circle, opt-out for surfacing).
/cirkel feed: cached remote_posts as static cards (source/avatar,
title, summary, cover, link to source). Only when tenancy=circle.
allow_circle column (ensureColumn) + CircleFederation respects it.
Output escaped everywhere + URL-scheme guards (http/https) against XSS import.