Make scanning an admin setting, and document SSO

The per-feed schedule picker is gone and global Settings is admin-only,
enforced in the handlers with 403s rather than just hidden: polling costs
bandwidth and affects everyone reading the feed, so it belongs to the
operator. Folders, keywords and per-feed limits stay open to anyone.

docs/sso.md covers Cloudflare Zero Trust and Authentik end to end,
including why trusted_proxies names the proxy and not a subnet.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AdXho5tTkjFLeUXKbEjKBh

PROGRESS.md

@@ -56,6 +56,23 @@ and until now nothing set them.
 
 ---
 
+## 2026-09-10 — Scanning is the operator's decision
+
+The per-feed **Check schedule** picker is gone from feed settings, and the global Settings page is
+hidden from anyone who is not an admin. Both are enforced in the handlers rather than merely hidden:
+`PATCH /api/settings` and a `schedule` in `PATCH /api/feeds/{id}` return 403 for an ordinary user.
+Polling costs bandwidth, is what a publisher notices, and one impatient setting affects everyone
+reading that feed -- it belongs in config.toml.
+
+Folders, keywords, per-feed download limits and the feed URL stay editable by anyone signed in.
+
+`docs/sso.md` covers putting Cloudflare Zero Trust or Authentik in front of ipx: the tunnel and
+Access application, the Authentik proxy provider and its forward-auth nginx block, the three lines
+of ipx config each needs, and why `trusted_proxies` must name the proxy rather than a subnet --
+with the command to prove the refusal works.
+
+---
+
 ## 2026-09-10 — Marking an item read
 
 Two bugs in one place. `epAction`'s `redraw` closure called *itself* when it had a row to