Release scheduling: published + future publish_at -> status 'scheduled'
(excluded from public status='published' queries). Scheduler.js publishes them
when the time is reached (setInterval 60s + on boot) + adds them to posts_fts.
No public queries changed -> low risk.
Fan-only: posts.fan_only; the single-post view shows anonymous visitors a
clean login gate (pages/fan-gate.ejs, link /auth/login?next=) instead of the
content; logged-in fans see everything. Listings show the teaser.