Accounts and sign-in, and fix the read toggle

epAction's redraw closure called itself when handed a row, so Mark read
recursed until the stack blew; it now swaps that row in place. Opening an
item also marks it read, redrawn where it stands so nothing vanishes from
under the pointer on the Unread tab.

Step A of multi-user: users and sessions tables, Argon2id, a session
cookie, ipx user subcommands, and a trusted proxy header for Cloudflare
Zero Trust -- honoured only from a trusted_proxies address. The shared
token still works and is the admin. A new database starts with
admin/ipodderx.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AdXho5tTkjFLeUXKbEjKBh

src/config.rs

@@ -71,8 +71,20 @@ pub struct Web {
     pub enabled: bool,
     /// Use 0.0.0.0 to reach it from the LAN. Anything but loopback needs the token.
     pub bind: String,
-    /// Shared secret. Generated and written back on first run when left empty.
+    /// Shared secret. Generated and written back on first run when left empty. It signs
+    /// in as the admin, which is what keeps the healthcheck and any scripts working.
     pub token: String,
+    /// A header naming the signed-in user, set by whatever fronts this -- Cloudflare Zero
+    /// Trust sends `Cf-Access-Authenticated-User-Email`. Empty disables the whole path.
+    pub trusted_header: String,
+    /// Addresses allowed to assert that header. A header is only as trustworthy as the
+    /// hop that set it, so an empty list means nobody: on a LAN-bound port anyone could
+    /// otherwise claim to be anyone. Loopback covers a tunnel running beside the daemon.
+    pub trusted_proxies: Vec<String>,
+    /// Create an account the first time the proxy vouches for a name it has not seen.
+    pub auto_create_users: bool,
+    /// Sign a session out after this long without a request.
+    pub session_days: i64,
 }
 
 impl Default for Web {
@@ -81,6 +93,10 @@ impl Default for Web {
             enabled: false,
             bind: "127.0.0.1:8080".into(),
             token: String::new(),
+            trusted_header: String::new(),
+            trusted_proxies: vec!["127.0.0.1".into(), "::1".into()],
+            auto_create_users: true,
+            session_days: 30,
         }
     }
 }