feat(store): NewestUnsummarizedVideoIDs for the onboarding cap

Returns up to limit of a user's newest videos (published_at DESC, NULLS LAST)
that have no summary yet. RLS-scoped via withUser — the test proves a second
user's newer video never leaks. Drives the connect-time onboarding burst
(Feature 1); the caller routes each through the shared rate gate.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/adapters/store/videos.go

@@ -72,3 +72,41 @@ func nullTime(t time.Time) *time.Time {
 	}
 	return &t
 }
+
+// NewestUnsummarizedVideoIDs returns up to limit of the user's videos that have
+// no summary yet, newest first (published_at DESC, NULLS LAST). It caps the
+// connect-time onboarding burst (Feature 1) at a fixed count: the caller marks
+// these for summarization through the shared rate gate. RLS-scoped via withUser,
+// so it only ever sees the requesting user's rows. limit <= 0 returns nil.
+func (s *Store) NewestUnsummarizedVideoIDs(ctx context.Context, userID string, limit int) ([]string, error) {
+	if limit <= 0 {
+		return nil, nil
+	}
+	var ids []string
+	if err := s.withUser(ctx, userID, func(tx pgx.Tx) error {
+		rows, err := tx.Query(ctx,
+			`SELECT v.id
+			   FROM videos v
+			  WHERE v.user_id = $1
+			    AND NOT EXISTS (
+			          SELECT 1 FROM summaries su
+			           WHERE su.user_id = v.user_id AND su.video_id = v.id)
+			  ORDER BY v.published_at DESC NULLS LAST, v.seen_at DESC
+			  LIMIT $2`, userID, limit)
+		if err != nil {
+			return fmt.Errorf("store: newest unsummarized: %w", err)
+		}
+		defer rows.Close()
+		for rows.Next() {
+			var id string
+			if err := rows.Scan(&id); err != nil {
+				return fmt.Errorf("store: scan newest unsummarized: %w", err)
+			}
+			ids = append(ids, id)
+		}
+		return rows.Err()
+	}); err != nil {
+		return nil, err
+	}
+	return ids, nil
+}