Upload an OPML file to import; tests for every way in and out

- The import screen has a file picker beside the paste box. The page
  reads the file, checks it looks like OPML before sending, and clears
  the picker when it is refused and after it is imported. The file is
  sent as text and never written to disk on the server.
- The server parses the OPML before touching anything and answers 400
  "that is not an OPML file" (was a 500). subscribe_opml takes a parsed
  document, so ipx import also refuses a non-OPML file by name.
- Tests: Settings' Export OPML download and paste import; uploading an
  RSS file (refused) and a real OPML; the server's 400; the admin's
  export round-tripped into a second account; ipx import/export in a
  scratch config.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016HdTEWQNrzyFULijigkmMn

CHANGELOG.md

@@ -5,6 +5,19 @@ matters, what was wrong before -- the reasoning is the point, not the diff.
 
 See [README.md](README.md) for what the thing is, and [docs/](docs/) for how to run it.
 
+## 2026-09-11 — Import an OPML file by uploading it
+
+The import screen now has a file picker as well as the paste box. The page reads the file and
+checks it looks like OPML before sending anything. If it doesn't, the page says so and clears the
+picker, and it also clears the picker after an import. The file travels as text and is never
+written to disk on the server, so there is nothing to clean up there.
+
+The server now parses the OPML before touching anything, and returns `400` "that is not an OPML
+file" instead of a `500`. `subscribe_opml` takes a parsed document, so `ipx import` also refuses a
+non-OPML file by name before changing anything.
+
+---
+
 ## 2026-09-11 — OPML import and export are per person
 
 Importing an OPML now subscribes you to every feed in it. Feeds already in the catalogue cost
@@ -17,6 +30,12 @@ through `subscribe_opml`.
 Export now lists only your own subscriptions. It used to write out the whole catalogue to anyone
 signed in, including other people's feeds and any private URLs in them.
 
+Tests now cover every way in and out:
+- Settings' Export OPML download and paste-to-import screen.
+- A round trip that imports the admin's actual export into a second account and checks both
+  exports match. That round trip is exactly what failed.
+- `ipx import` and `ipx export`, run in their own scratch config and database.
+
 ---
 
 ## 2026-09-11 — The log is admin-only