Task: Repair the web after the feed rename

The web build is green again, and the web and the BFF speak of feeds, not sources.

• The BFF imports the feed protocol and reads feeds, not sources.
• The routes name feeds and publisher codes; the official rates read resolves the fixing source to a feed.
• The web pages, paths, cards and journeys say feed; the source protocol import is gone.
• The BFF and web tests pass and the lint is clean.

(Implementation strategy. Written when work starts; key decisions are distilled into the parent story's * Decisions at close, but the plan itself stays — it is the historical record of what we did.)

Every number this task claims about a tree, with the command that produced it and the commit it was measured at. A number without both is not a measurement, because a clean-up record describes a tree and trunk moves under a branch: a consumer count, a gate's component count and a suite's size all change with no code changing, and the reader of a bare number cannot tell which tree it came from. Where the raw output matters, put it in an evidence/ file beside the task and name that file in the Command column.

Manual QA scenarios (scaffolded via compass add test_scenario) that verify this task. Link new ones here as they're created; the scenario doc itself links back via its "Verifies task" field.

The web and the BFF speak of feeds, and the rename's runtime defects are fixed.

• The BFF reads the feeds (the feed protocol), answers them with the feed fields, and groups the official providers from their feeds; a series matches a feed by publisher_code and provider_key, and a series no feed names is logged rather than dropped.
• The routes read and write publisher_code and feed_id; the delete key is publisher_code.
• The web page, API module, paths, card, related journeys, routes and the en/fr/pt catalogues say feed; /operations/market-data-feeds replaces /operations/market-data-sources.
• Two defects in the earlier patch are fixed: the feed list was read as running_feeds (synthetic's member; marketdata answers feeds), and the route delete sent provider_code where the key is publisher_code. The feeds card asked for a permission no role holds; it now asks marketdata::feeds:read.
• Checks: the BFF tsc, the web tsc+vite, the BFF vitest (84 files, 1152 tests), the web vitest (186 files, 2333 tests), compass lint, the route inventory and prettier all pass.

Left open: the route key carries only publisher_code while the natural key includes asset_class; a feed has no kind; provider_key may be empty or shared, so the series match is not unique; the feeds journey doc still uses the old source language, which belongs to the suppliers, sessions and feeds story.